Threats tagged 'ghsa-m997-8g56-6phf'

A command injection vulnerability exists in agentscope-ai AgentScope up to version 2.0.11 in the subprocess.Popen function within src/agentscope/mcp/_config.py of the MCP Workspace API component. This vulnerability allows remote attackers to execute arbitrary OS commands by manipulating the command argument. Public exploit code is available, and a fix is pending acceptance in a pull request.