CVE-2026-123022

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123022", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-05T06:25:52.002Z", "datePublished": "2026-11-05T13:15:23.092Z", "dateUpdated": "2026-11-05T16:38:27.335Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T13:15:23.092Z"}, "title": "agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "agentscope-ai", "product": "AgentScope", "versions": [{"version": "2.0.0", "status": "affected"}, {"version": "2.0.1", "status": "affected"}, {"version": "2.0.2", "status": "affected"}, {"version": "2.0.3", "status": "affected"}, {"version": "2.0.4", "status": "affected"}, {"version": "2.0.5", "status": "affected"}, {"version": "2.0.6", "status": "affected"}, {"version": "2.0.7", "status": "affected"}, {"version": "2.0.8", "status": "affected"}, {"version": "2.0.9", "status": "affected"}, {"version": "2.0.10", "status": "affected"}, {"version": "2.0.11", "status": "affected"}], "cpes": ["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"], "modules": ["MCP Workspace API"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-05T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-05T07:31:06.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ybyu (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/431395", "name": "VDB-431395 | agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431395/cti", "name": "VDB-431395 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-123022", "name": "CVE-2026-123022 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1033130", "name": "Submit #1033130 | agentscope-ai AgentScope 2.0.4 CWE-78 Improper Neutralization of Special Elements used in an OS", "tags": ["third-party-advisory"]}, {"url": "https://github.com/agentscope-ai/agentscope/issues/3312", "tags": ["issue-tracking"]}, {"url": "https://github.com/agentscope-ai/agentscope/pull/3448", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md", "tags": ["exploit"]}, {"url": "https://github.com/agentscope-ai/agentscope/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:30:47.739617Z", "id": "CVE-2026-123022", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:38:27.335Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123022", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T16:30:47.739617Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:30:37.850Z"}}], "cna": {"title": "agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "Ybyu (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"], "vendor": "agentscope-ai", "modules": ["MCP Workspace API"], "product": "AgentScope", "versions": [{"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.0.4"}, {"status": "affected", "version": "2.0.5"}, {"status": "affected", "version": "2.0.6"}, {"status": "affected", "version": "2.0.7"}, {"status": "affected", "version": "2.0.8"}, {"status": "affected", "version": "2.0.9"}, {"status": "affected", "version": "2.0.10"}, {"status": "affected", "version": "2.0.11"}]}], "timeline": [{"lang": "en", "time": "2026-11-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-05T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-05T07:31:06.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431395", "name": "VDB-431395 | agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431395/cti", "name": "VDB-431395 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-123022", "name": "CVE-2026-123022 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1033130", "name": "Submit #1033130 | agentscope-ai AgentScope 2.0.4 CWE-78 Improper Neutralization of Special Elements used in an OS", "tags": ["third-party-advisory"]}, {"url": "https://github.com/agentscope-ai/agentscope/issues/3312", "tags": ["issue-tracking"]}, {"url": "https://github.com/agentscope-ai/agentscope/pull/3448", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md", "tags": ["exploit"]}, {"url": "https://github.com/agentscope-ai/agentscope/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T13:15:23.092Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123022", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:38:27.335Z", "dateReserved": "2026-11-05T06:25:52.002Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T13:15:23.092Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"], "modules": ["MCP Workspace API"], "product": "AgentScope", "vendor": "agentscope-ai", "versions": [{"status": "affected", "version": "2.0.0"}, {"status": "affected", "version": "2.0.1"}, {"status": "affected", "version": "2.0.2"}, {"status": "affected", "version": "2.0.3"}, {"status": "affected", "version": "2.0.4"}, {"status": "affected", "version": "2.0.5"}, {"status": "affected", "version": "2.0.6"}, {"status": "affected", "version": "2.0.7"}, {"status": "affected", "version": "2.0.8"}, {"status": "affected", "version": "2.0.9"}, {"status": "affected", "version": "2.0.10"}, {"status": "affected", "version": "2.0.11"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/_config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance."}], "id": "CVE-2026-123022", "lastModified": "2026-11-05T17:18:01.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123022", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:30:47.739617Z", "version": "2.0.3"}}]}, "published": "2026-11-05T14:17:04.003", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/agentscope-ai/agentscope/"}, {"source": "cna@vuldb.com", "url": "https://github.com/agentscope-ai/agentscope/issues/3312"}, {"source": "cna@vuldb.com", "url": "https://github.com/agentscope-ai/agentscope/pull/3448"}, {"source": "cna@vuldb.com", "url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-123022"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1033130"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431395"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431395/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "agentscope: AgentScope: Arbitrary command execution via command injection in MCP Workspace API", "id": "2567640", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567640"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["A flaw was found in AgentScope. A remote attacker can exploit this command injection vulnerability by submitting manipulated command parameters to the Model Context Protocol (MCP) Workspace API. Because input is passed directly to system execution functions without adequate validation, an attacker can execute arbitrary commands on the host system. This may lead to unauthorized access, data compromise, and full host takeover."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123022", "public_date": "2026-11-05T13:15:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123022\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123022\nhttps://github.com/agentscope-ai/agentscope/\nhttps://github.com/agentscope-ai/agentscope/issues/3312\nhttps://github.com/agentscope-ai/agentscope/pull/3448\nhttps://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-mcp-stdio-workspace-unauthenticated-process-execution.md\nhttps://vuldb.com/cve/CVE-2026-123022\nhttps://vuldb.com/submit/1033130\nhttps://vuldb.com/vuln/431395\nhttps://vuldb.com/vuln/431395/cti"], "statement": "This vulnerability is rated as Critical impact because unauthenticated network users can execute arbitrary commands with the privileges of the running application, resulting in complete compromise of host confidentiality, integrity, and availability. AgentScope is not included or shipped within Red Hat Enterprise Linux or other supported Red Hat software distributions. Consequently, default Red Hat operating system deployments are not exposed to this flaw unless third-party instances of this agent framework are manually deployed and configured.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.0.11"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "AgentScope", "source": "cna", "vendor": "agentscope-ai"}, "product": "agentscope", "vendor": "agentscope-ai"}], "created": "2026-11-05T15:15:19.578426+00:00", "updated": "2026-11-06T15:00:08.018014+00:00", "vendors": ["agentscope-ai", "agentscope-ai$PRODUCT$agentscope"]}