CVE-2026-123023

EUVD-2026-117442
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/agentscope-ai/agentscope/
https://github.com/agentscope-ai/agentscope/commit/6b43b13a46401e86abd3defeed9a8bfe5b37bc6d
https://github.com/agentscope-ai/agentscope/issues/3313
https://github.com/agentscope-ai/agentscope/pull/2629
https://github.com/agentscope-ai/agentscope/releases/tag/v2.0.9
https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-bash-tool-tee-misclassification-arbitrary-file-write.md
https://vuldb.com/cve/CVE-2026-123023
https://vuldb.com/submit/1033131
https://vuldb.com/vuln/431396
https://vuldb.com/vuln/431396/cti