CVE-2026-123023

AgentScope treats the file-writing tee command as read-only

agentscope-ai · AgentScope Bash tool

First documented disclosure · Review checkpoint

Summary

A shell pipeline can write or append to a file without the approval normally required for a write.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: A controlled test wrote a file through tee without a confirmation. A comparison using shell redirection prompted for approval. Malicious use was not reported.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The permission check classifies tee as safe and returns before the later checks examine the destination file.

Conditions required

An attacker can influence a shell command submitted to the agent. The process must have write permission on the destination.

Potential impact

Files writable by the agent can be changed without the expected confirmation.

Affected versions and configurations

VulDB lists releases through 2.0.8. The researcher tested 2.0.4.

Fix and mitigation status

2.0.9 contains the fix identified by the CNA. PR 2629 removes tee from the read-only list.

Practical next steps

Update to a release containing the fix and audit file changes made by agents with shell access.

Operating lesson

Check the side effects of every command in a pipeline before approving it as read-only.

Evidence and limits

The public fix proposal appeared September 14 and the fixed release September 28. The separate researcher report in October describes testing an earlier build.

Sources