CVE-2026-123022

The agentscope-ai AgentScope software (up to version 2.0.11 ) is vulnerable to an os command injection in the MCP Workspace API component. The root cause is the improper handling of the command argument within the subprocess.Popen function located in src/agentscope/mcp/_config.py. This vulnerabil...