CVE-2026-18974: heshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosure
A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18974?
The severity of CVE-2026-18974 is medium with a score of 5.3.
What type of vulnerability is CVE-2026-18974?
CVE-2026-18974 is classified as an information disclosure vulnerability.
What component is affected by CVE-2026-18974?
CVE-2026-18974 affects the execute_tool_manually Endpoint in the heshengtao super-agent-party software.
How does CVE-2026-18974 lead to information disclosure?
CVE-2026-18974 allows manipulation of the arguments tool_name/tool_params in the get_file_content function, which results in information disclosure.
How can I mitigate the effects of CVE-2026-18974?
To mitigate CVE-2026-18974, ensure that you validate all inputs thoroughly and limit access to sensitive information within the affected component.