CVE-2026-18974 affects heshengtao super-agent-party versions up to 0.4.1. The vulnerability resides in the get_file_content function of server.py in the execute_tool_manually endpoint. An attacker can manipulate the tool_name or tool_params arguments to disclose information remotely. The vulnerability is classified under CWE-200 (Information Exposure). The CVSS v3.1 base score is 5.3 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. Public exploit code exists, but the vendor has not responded or issued a patch.

Successful exploitation allows an unauthenticated remote attacker to disclose sensitive information by manipulating input parameters. There is no impact on integrity or availability. The confidentiality impact is limited but could expose sensitive data handled by the vulnerable function.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to the vulnerable endpoint and monitor for exploitation attempts. Apply any vendor updates promptly if they become available.