CVE-2026-123022 agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injection

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be...