CVE-2026-123022 - Vulnerability Details

- agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection

Description

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

Published: 2026-11-05

Score: 6.9 Medium

EPSS: 1.6% Low

KEV: No

Impact:

Action:

Analysis

Impact

A command injection flaw exists in the subprocess.Popen usage within agentscope-ai's AgentScope MCP Workspace API. By manipulating the command argument, an attacker can inject and execute arbitrary operating system commands, resulting in a full remote code execution vulnerability. The flaw is present in all releases up to version 2.0.11 and carries a CVSS score of 6.9, indicating moderate to high severity. The issue has been publicly disclosed and exploits are actively available.

Affected Systems

The affected product is agentscope-ai AgentScope, specifically the MCP Workspace API component. All instances using AgentScope versions up to and including 2.0.11 are vulnerable. No specific environments or additional vendors are listed.

Risk and Exploitability

Based on the description, the likely attack vector is remote API access to the MCP Workspace API; an attacker supplies a crafted command argument to the subprocess.Popen call. The publicly available exploit and the lack of mitigation in current versions mean that any reachable installation is at risk. The vulnerability remains unpatched until a security fix is merged and a new release is published. The EPSS score indicates a 2% likelihood that this vulnerability will be exploited.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

agentscope-ai

AgentScope

affected

Version	Status	Constraints
`2.0.0`	affected	—
`2.0.1`	affected	—
`2.0.2`	affected	—
`2.0.3`	affected	—
`2.0.4`	affected	—
`2.0.5`	affected	—
`2.0.6`	affected	—
`2.0.7`	affected	—
`2.0.8`	affected	—
`2.0.9`	affected	—
`2.0.10`	affected	—
`2.0.11`	affected	—

No data.

Vendor Product Confidence Versions

Agentscope-ai

Agentscope

95%

Version	Status	Scheme	Platform
`2.0.0`	affected	semver	—
`2.0.1`	affected	semver	—
`2.0.2`	affected	semver	—
`2.0.3`	affected	semver	—
`2.0.4`	affected	semver	—
`2.0.5`	affected	semver	—
`2.0.6`	affected	semver	—
`2.0.7`	affected	semver	—
`2.0.8`	affected	semver	—
`2.0.9`	affected	semver	—
`2.0.10`	affected	semver	—
`2.0.11`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest AgentScope release once the security fix has been merged (e.g., any version above 2.0.11).
In the interim, disable or restrict external access to the MCP Workspace API to prevent unauthorized command injection.
If disabling is not possible, implement input validation on the command parameter, restricting it to a whitelist of allowed commands or using strict parsing to eliminate injection vectors.
Apply runtime confinement such as SELinux, AppArmor, or container isolation to limit the execution privileges of spawned processes, and monitor logs for unexpected subprocess activity.

Generated by OpenCVE AI on November 6, 2026 at 14:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01638.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/agentscope-ai/agentscope/
https://github.com/agentscope-ai/agentscope/issues/3312
https://github.com/agentscope-ai/agentscope/pull/3448
https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md
https://nvd.nist.gov/vuln/detail/CVE-2026-123022
https://vuldb.com/cve/CVE-2026-123022
https://vuldb.com/submit/1033130
https://vuldb.com/vuln/431395
https://vuldb.com/vuln/431395/cti
https://www.cve.org/CVERecord?id=CVE-2026-123022

History

Fri, 06 Nov 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-123022 https://www.cve.org/CVERecord?id=CVE-2026-123022
Metrics	threat_severity `None`	threat_severity `Critical`

Thu, 05 Nov 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 05 Nov 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Title		agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
First Time appeared		Agentscope-ai Agentscope-ai agentscope
Weaknesses		CWE-77 CWE-78
CPEs		cpe:2.3:a:agentscope-ai:agentscope::::::::
Vendors & Products		Agentscope-ai Agentscope-ai agentscope
References		https://github.com/agentscope-ai/agentscope/ https://github.com/agentscope-ai/agentscope/issues/3312 https://github.com/agentscope-ai/agentscope/pull/3448 https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md https://vuldb.com/cve/CVE-2026-123022 https://vuldb.com/submit/1033130 https://vuldb.com/vuln/431395 https://vuldb.com/vuln/431395/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Agentscope-ai Agentscope

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-11-05T13:15:23.092Z

Updated: 2026-11-05T16:38:27.335Z

Reserved: 2026-11-05T06:25:52.002Z

Link: CVE-2026-123022

Vulnrichment

Updated: 2026-11-05T16:30:37.850Z

NVD

Status : Deferred

Published: 2026-11-05T14:17:04.003

Modified: 2026-11-05T17:18:01.393

Link: CVE-2026-123022

Redhat

Severity : Critical

Publid Date: 2026-11-05T13:15:23Z

Links: CVE-2026-123022 - Bugzilla

OpenCVE Enrichment

Updated: 2026-11-06T15:00:08Z

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object