agentscope-ai vulnerabilities and threats

CVE-2026-123024 is a medium-severity vulnerability in agentscope-ai AgentScope versions 2.0.0 through 2.0.11. It affects the get_current_user_id function in the Agent Service component, where manipulation of the X-User-ID argument leads to missing authentication. This flaw allows remote attackers to bypass authentication controls. A fix has been proposed but is not yet accepted or available.

CVE-2026-123023 is an authorization flaw in agentscope-ai AgentScope versions 2.0.0 through 2.0.8 affecting the check_permissions function in the Bash Tool component. This vulnerability allows remote attackers to bypass proper authorization checks. Exploit code has been published publicly. Upgrading to version 2.0.9 addresses the issue.

CVE-2026-123022 is an OS command injection vulnerability in agentscope-ai AgentScope versions 2.0.0 through 2.0.11. It affects the subprocess.Popen function in the MCP Workspace API component, allowing remote attackers to inject operating system commands via manipulated arguments. Public exploit code is available, but a fix is pending acceptance of a pull request.

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.