This vulnerability in heshengtao super-agent-party up to version 0.4.1 involves improper handling of input parameters (tool_name/tool_params) in the get_file_content function of the execute_tool_manually endpoint, leading to information disclosure. The flaw can be exploited remotely without authentication or user interaction. Public exploit code exists, but the vendor has not provided any official fix or response. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability.

An attacker can remotely manipulate input parameters to the affected function to disclose sensitive information from the system. The impact is limited to information disclosure with no direct impact on system integrity or availability. The medium severity rating reflects the potential for sensitive data exposure but not system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected endpoint and monitor for exploitation attempts. Applying network-level controls to limit exposure of the execute_tool_manually endpoint may reduce risk until a patch is released.