180 matches found
CVE-2024-8550
A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...
PYSEC-2025-84
A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...
CVE-2024-8550 Local File Inclusion (LFI) in modelscope/agentscope
A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...
CVE-2024-8550
CVE-2024-8550 affects modelscope/agentscope v0.0.4, exposing a Local File Inclusion (LFI) via the /load-workflow endpoint. Root cause: improper sanitization of the filename parameter passed to os.path.join allows traversal outside the intended directory, enabling an attacker to read arbitrary ser...
CVE-2024-8550 Local File Inclusion (LFI) in modelscope/agentscope
A Local File Inclusion LFI vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue aris...
AgentScope 安全漏洞
AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version 0.0.4, which stems from a local file inclusion vulnerability in the /load-workflow endpoint that allows an attacker to read...
Code Injection
AgentScope is vulnerable to Code Injection. The vulnerability is due to the eval function in the iscallableexpression function, which executes user-provided commands, allowing potential code injection...
PT-2024-39089 · Unknown · Modelscope/Agentscope
Name of the Vulnerable Software and Affected Versions: modelscope/agentscope version v0.0.4 Description: A Local File Inclusion LFI vulnerability exists in the "/load-workflow" endpoint, allowing an attacker to read arbitrary files from the server, including sensitive files such as API keys, by...
Eval Injection
Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Eval Injection via the result = evals field of the iscallableexpression function in the agentscope\web\workstation\workflowutils.py file. An attacker can execute...
tashan-scispark (>=1.0.1 <=1.0.8) potentially affected by CVE-2024-48050 via agentscope (=0.1.0)
agentscope PYPI version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2024-48050 Source advisory: OSV:GHSA-6P55-QR3J-MPGQ...
AgentScope uses `eval`
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
PYSEC-2024-262
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
CVE-2024-48050
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
PYSEC-2024-262
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
CVE-2024-48050
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
AgentScope 安全漏洞
AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version v0.0.4, which stems from the fact that the iscallableexpression function in the agentscopewebworkstationworkflowutils.py file can...
CVE-2024-48050
CVE-2024-48050 affects AgentScope
PT-2024-32970 · Unknown · Agentscope
Name of the Vulnerable Software and Affected Versions: agentscope versions 0.0.0 through 0.0.4 Description: The issue is related to the function is callable expression in the file agentscopewebworkstationworkflow utils.py. This function contains the line result = evals, which poses a security ris...
CVE-2024-48050
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...
CVE-2024-48050
In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...