Information disclosure in Heshengtao Super-Agent-Party
CVE-2026-18974
A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability class: Information Disclosure
EPSS: 0.003 (24.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Heshengtao Super-agent-party — versions 0.4.0, 0.4.1
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (exploit)
Frequently asked questions
- What is CVE-2026-18974?
- CVE-2026-18974 is a medium-severity vulnerability in Heshengtao Super-Agent-Party, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-08-06.
- How severe is CVE-2026-18974?
- Medium severity. CVSS v3 base score is 5.3 out of 10.