{"id":"CVE-2026-123023","kind":"vulnerability","aliases":["CVE-2026-123023"],"related":[],"title":"AgentScope: Bash tool authorization flaw lets remote users bypass permission checks","description":"A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.","summary":"AgentScope is an agent framework, and its built-in Bash tool checks permissions incorrectly in versions up to 2.0.8. A remote attacker can exploit this, and a published exploit exists, so the agent may be made to run commands it should be blocked from running.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agentscope","ai-agents","ai-tooling","bash-tool","python"],"not_affected_if":["bash-tool-disabled","version-2.0.9-or-later"],"how_to_check":"- Check the installed AgentScope version with `pip show agentscope` or the lockfile, and look for any version up to `2.0.8`.\n- Look for use of the Bash tool (`src/agentscope/tool/_builtin/_bash.py`) in agents that accept input from outside users.","fix":"- Upgrade AgentScope to `2.0.9`, per the source.","status":"open","published_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:21+00:00","updated_at":"2026-11-05T14:40:21+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-05T14:40:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AgentScope to `2.0.9`, per the source.","reach":"internet","title":"AgentScope: Bash tool authorization flaw lets remote users bypass permission checks","impact":"high","summary":"AgentScope is an agent framework, and its built-in Bash tool checks permissions incorrectly in versions up to 2.0.8. A remote attacker can exploit this, and a published exploit exists, so the agent may be made to run commands it should be blocked from running.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["agentscope","python","ai-agents","bash-tool"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote input could make the agent run shell commands without authorization.","analyst_note":"Confirm the attack preconditions and whether the Bash tool is enabled by default; check the linked patch and release notes for details.","how_to_check":"- Check the installed AgentScope version with `pip show agentscope` or the lockfile, and look for any version up to `2.0.8`.\n- Look for use of the Bash tool (`src/agentscope/tool/_builtin/_bash.py`) in agents that accept input from outside users.","plain_action":"","needs_analyst":true,"not_affected_if":["bash-tool-disabled","version-2.0.9-or-later"],"who_is_affected":"Teams running AgentScope up to 2.0.8 with the built-in Bash tool enabled, especially where agents take input from untrusted users. Projects that do not use the Bash tool or that run on a later version are not exposed per the sources. The sources do not describe the exact configuration needed to trigger the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4326,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123023':14A,17A '-2026':13A,16A '2.0.8':48B,87C '2.0.9':127C '6b43b13a46401e86abd3defeed9a8bfe5b37bc6d':133C 'affect':89C,140C 'agent':21B,32B,62B 'agentscop':1A,18B,29B,82C,84C 'agentscope-ai':81C 'ai':20B,23B,83C 'ai-ag':19B 'ai-tool':22B 'attack':51B,112C 'author':4A,107C 'bash':2A,26B,39B,101C 'bash-tool':25B 'block':72B 'built':37B 'built-in':36B 'bypass':9A 'caus':105C 'check':11A,41B,92C 'command':68B 'compon':100C,141C 'cve':12A,15A 'exist':59B 'exploit':53B,58B,109C,116C 'file':96C 'flaw':5A,76C 'found':79C 'framework':33B 'function':91C 'incorrect':43B,106C 'issu':130C 'let':6A 'made':65B 'manipul':104C 'may':63B,121C 'mitig':128C 'name':132C 'patch':131C 'permiss':10A,42B,93C 'possibl':114C 'publish':57B,119C 'python':28B 'recommend':136C 'remot':7A,50B,108C 'run':67B,74B 'src/agentscope/tool/_builtin/_bash.py':97C 'tool':3A,24B,27B,40B,102C 'upgrad':124C,138C 'use':123C 'user':8A 'version':45B,126C","nicknames":[],"mitigations":[],"who_affected":"Teams running AgentScope up to 2.0.8 with the built-in Bash tool enabled, especially where agents take input from untrusted users. Projects that do not use the Bash tool or that run on a later version are not exposed per the sources. The sources do not describe the exact configuration needed to trigger the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentscope","aiagents","aitooling","bashtool","high","python"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123023","severity":null,"published_at":"2026-11-05T14:17:04+00:00","modified_at":"2026-11-05T14:17:04+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null}],"documents":[{"id":76816,"url":"https://github.com/agentscope-ai/agentscope/commit/6b43b13a46401e86abd3defeed9a8bfe5b37bc6d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":76817,"url":"https://github.com/agentscope-ai/agentscope/releases/tag/v2.0.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}