What happened
AgentScope's MCP Workspace API builds a subprocess command from an attacker-influenced argument, enabling remote OS command injection (public PoC). Separately, the Agent Service resolves the current user from a caller-supplied X-User-ID (missing authentication), and the Bash tool's permission check is incorrect in versions up to 2.0.8, allowing otherwise-restricted commands.
Why it matters
AgentScope provides an agent runtime with a Bash tool and an MCP workspace where agents execute commands. These flaws let an attacker inject operating-system commands or impersonate any user to run agent tools, compromising the host where agents and their credentials live.
Attack vector
Remote attacker triggers OS command injection through the MCP Workspace API command argument, or abuses the X-User-ID header to bypass authentication on the Agent Service, or exploits weaker-than-expected authorization in the Bash tool to run commands that should be blocked.
Affected systems
AgentScope <= 2.0.11 (command injection, auth bypass); <= 2.0.8 (Bash tool authorization)
Mitigation
No released fix yet — the fix PR (agentscope#3448) is pending acceptance; monitor for a patched release, restrict exposure of the MCP workspace and Agent Service endpoints, and do not pass untrusted command strings to the workspace API.