CVE-2024-8438

Summary: CVE-2024-8438 describes a path traversal in modelscope/agentscope v0.0.4 where the /api/file endpoint does not sanitize the path parameter, enabling reading arbitrary server files. The underlying impact is information disclosure with a high severity (CVSS3/7.5) but no exploitation detail...

CVE-2024-8502

CVE-2024-8502 affects modelscope/agentscope (v0.0.6a3). The RpcAgentServerLauncher.AgentServerServicer.create_agent path deserializes untrusted input with dill.loads, enabling remote code execution. Impact is described as arbitrary commands execution on the server; CVE is reported across multiple...

CVE-2024-8502 Remote Code Execution via Deserialization in modelscope/agentscope

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

CVE-2024-8502 Remote Code Execution via Deserialization in modelscope/agentscope

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

CVE-2024-8489

CVSS 8.8 (HIGH) — CVE-2024-8489: CSRF in modelscope/agentscope, specifically the AgentScope Studio backend server. The issue stems from overly permissive CORS headers, allowing CSRF to access all backend endpoints, including the api/file endpoint for reading arbitrary files on the target’s local ...

CVE-2024-8489 CSRF due to overly permissive CORS headers in modelscope/agentscope

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery CSRF due to overly permissive CORS headers. This issue affects the latest commit on the main branch 21161fe. The vulnerability permits an attacker to access all...

CVE-2024-8489 CSRF due to overly permissive CORS headers in modelscope/agentscope

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery CSRF due to overly permissive CORS headers. This issue affects the latest commit on the main branch 21161fe. The vulnerability permits an attacker to access all...

CVE-2024-8501 Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

CVE-2024-8501 Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version v0.0.4, which stems from the rpcagentclient component that allows arbitrary file downloads, an attacker can utilize the downloadfi...

AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version v0.0.4 that stems from a CORS configuration that does not properly restrict access, allowing any external domain to make requests ...

AgentScope 代码问题漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A code issue vulnerability exists in AgentScope version v0.0.6a3, which stems from the RpcAgentServerLauncher class deserializing untrustworthy data via the dill library leading to...

AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope that stems from user-controllable strings that are not properly cleaned and escaped, which could lead to a stored cross-site scripting...

AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope that stems from the presence of path traversal in the /delete-workflow endpoint, which allows an attacker to delete arbitrary files in the...

AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version 0.0.4, which stems from the presence of directory traversal in the /read-examples endpoint, which allows an attacker to read...

AgentScope 路径遍历漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A path traversal vulnerability exists in AgentScope version v0.0.4, which stems from the API endpoint /api/file not properly cleaning up the path parameter, allowing an attacker to rea...

AgentScope 跨站请求伪造漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. AgentScope suffers from a cross-site request forgery vulnerability that stems from the CORS header on the AgentScope Studio backend server being configured too loosely to allow...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere due to insecure initialization of the DEFAULTCACHEDIR in app.py, using of user input...

tashan-scispark (>=1.0.1 <=1.0.8) potentially affected by CVE-2024-8550 via agentscope (=0.1.0)

agentscope PYPI version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2024-8550 Source advisory: SNYK:PYTHON-AGENTSCOPE-8715662...

PYSEC-2025-84

A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...