CVE-2026-123022 | agentscope-ai AgentScope up to 2.0.11 MCP Workspace API _config.py subprocess.Popen command os command injection (Issue 3312)

November 5, 2026 Yanac

A vulnerability described as critical has been identified in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection.

This vulnerability is cataloged as CVE-2026-123022. The attack may be launched remotely. Furthermore, there is an exploit available.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More