CVE-2026-123023 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
AgentScope is an agent framework, and its built-in Bash tool checks permissions incorrectly in versions up to 2.0.8. A remote attacker can exploit this, and a published exploit exists, so the agent may be made to run commands it should be blocked from running.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running AgentScope up to 2.0.8 with the built-in Bash tool enabled, especially where agents take input from untrusted users. Projects that do not use the Bash tool or that run on a later version are not exposed per the sources. The sources do not describe the exact configuration needed to trigger the flaw.
Not affected if bash-tool-disabled, version-2.0.9-or-later
Who cares agentscope, ai-agents, bash-tool, python
pip show agentscope or the lockfile, and look for any version up to 2.0.8.src/agentscope/tool/_builtin/_bash.py) in agents that accept input from outside users.2.0.9, per the source.A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.