CVE-2026-123022: agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Event History
Frequently Asked Questions
Which deployments should be prioritized for assessment?
Prioritize AgentScope deployments at version 2.0.11 or earlier that expose or use the MCP Workspace API, because the affected code is in its _config.py component.
Does exploitation require an authenticated user or user interaction?
The provided vector indicates no privileges are required and no user interaction is required. The attack can be launched remotely.
How urgent is remediation?
A public exploit is available, which increases the likelihood of attempted exploitation. The referenced fix is still awaiting acceptance, so a confirmed released remediation is not identified in the provided data.
How can I determine whether an environment is affected?
Check whether AgentScope is deployed at version 2.0.11 or earlier and whether the MCP Workspace API is present or exposed. The supplied information does not provide a behavioral indicator or log signature for confirming exploitation.