CVE-2026-123022

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-123022
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123022.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-123022
Published
2026-11-05T13:15:23Z
Modified
2026-11-05T21:32:22Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection
Details

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123022.json"
}
References

Affected packages

Git / github.com/agentscope-ai/agentscope

Affected ranges

Type
GIT
Repo
https://github.com/agentscope-ai/agentscope
Events
Introduced
edd7cfdc11923549b1b3cc2d829ba59b2c7a49bb
Last Affected
8af9d25784e704a4b11d71bd673257c68505fcb8
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.1"
                },
                {
                    "last_affected": "2.0.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.2"
                },
                {
                    "last_affected": "2.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.3"
                },
                {
                    "last_affected": "2.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.4"
                },
                {
                    "last_affected": "2.0.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.5"
                },
                {
                    "last_affected": "2.0.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.6"
                },
                {
                    "last_affected": "2.0.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.7"
                },
                {
                    "last_affected": "2.0.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.8"
                },
                {
                    "last_affected": "2.0.8"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.9"
                },
                {
                    "last_affected": "2.0.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.10"
                },
                {
                    "last_affected": "2.0.10"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "2.0.11"
                },
                {
                    "last_affected": "2.0.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.10
2.0.11
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.2
v2.0.3
v2.0.4
v2.0.4.post1
v2.0.5
v2.0.6
v2.0.7
v2.0.7.post1
v2.0.8
v2.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-123022.json"