---
id: CVE-2026-123022
title: >-
  agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os
  command injection
summary: >-
  A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The
  impacted element is the function subprocess.Popen of the file
  src/agentscope/mcp/_config.py of the component MCP Workspace API. The
  manipulation of the argument c…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-77
vendor: agentscope-ai
product: AgentScope
affected:
  - AgentScope 2.0.0
  - AgentScope 2.0.1
  - AgentScope 2.0.2
  - AgentScope 2.0.3
  - AgentScope 2.0.4
  - AgentScope 2.0.5
  - AgentScope 2.0.6
  - AgentScope 2.0.7
  - AgentScope 2.0.8
  - AgentScope 2.0.9
  - AgentScope 2.0.10
  - AgentScope 2.0.11
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T16:30:47.739617Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:38:27.335Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123022'
references:
  - url: 'https://vuldb.com/vuln/431395'
    label: >-
      VDB-431395 | agentscope-ai AgentScope MCP Workspace API _config.py
      subprocess.Popen os command injection
  - url: 'https://vuldb.com/vuln/431395/cti'
    label: 'VDB-431395 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-123022'
    label: CVE-2026-123022 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1033130'
    label: >-
      Submit #1033130 | agentscope-ai AgentScope 2.0.4 CWE-78 Improper
      Neutralization of Special Elements used in an OS
  - url: 'https://github.com/agentscope-ai/agentscope/issues/3312'
  - url: 'https://github.com/agentscope-ai/agentscope/pull/3448'
  - url: >-
      https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md
  - url: 'https://github.com/agentscope-ai/agentscope/'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.374Z'
---

## Overview

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

## Affected

- `AgentScope 2.0.0`
- `AgentScope 2.0.1`
- `AgentScope 2.0.2`
- `AgentScope 2.0.3`
- `AgentScope 2.0.4`
- `AgentScope 2.0.5`
- `AgentScope 2.0.6`
- `AgentScope 2.0.7`
- `AgentScope 2.0.8`
- `AgentScope 2.0.9`
- `AgentScope 2.0.10`
- `AgentScope 2.0.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.