PYSEC-2026-253 AgentScope Deserialization Vulnerability

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

tashan-scispark (>=1.0.1, <=1.0.8) potentially affected by CVE-2024-8551 via agentscope (0.1.0)

agentscope PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2024-8551 Source advisory: OSV:PYSEC-2026-255...

AgentScope path traversal vulnerability in save-workflow

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of...

AgentScope path traversal vulnerability

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

PYSEC-2026-254 AgentScope path traversal vulnerability

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

tashan-scispark (>=1.0.1, <=1.0.8) potentially affected by CVE-2024-8537 via agentscope (0.1.0)

agentscope PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2024-8537 Source advisory: OSV:PYSEC-2026-254...

PT-2026-53352

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of...

PT-2026-53350

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create agent method, where serialized input is deserialized using...

PT-2026-53351

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

CVE-2026-6605

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function getbytesfromweburl of the file src/agentscope/utils/common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate the...

CVE-2026-6603

A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function executepythoncode/executeshellcommand of the file src/AgentScope/tool/coding/python.py. This manipulation causes code injection. The attack is possible to be carried out remotely...

CVE-2026-6604

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parseurl/prepareimage/openaiaudiototext of the file src/agentscope/tool/multimodality/openaitools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

CVE-2026-6606

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function processaudioblock of the file src/agentscope/agent/agentbase.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +15 more potentially affected by CVE-2026-6606 via agentscope (>=1.0.5, <=1.0.18)

agentscope PYPI version =1.0.5, =1.0.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0.post1, =1.1.0a1, =1.0.2, =0.1.7, =0.0.0.1, =1.0.0.0, =1.0.0.2 and more Source cves: CVE-2026-6606 Source advisory: OSV:GHSA-CRX8-WPV6-JRJ2...

tashan-scispark (>=1.0.1, <=1.0.8) potentially affected by CVE-2026-6606 via agentscope (0.1.0)

agentscope PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2026-6606 Source advisory: OSV:GHSA-CRX8-WPV6-JRJ2...

EUVD-2026-23777

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function processaudioblock of the file src/agentscope/agent/agentbase.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack...

GHSA-CRX8-WPV6-JRJ2 AgentScope vulnerable to Server-Side Request Forgery

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function processaudioblock of the file src/agentscope/agent/agentbase.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack...

AgentScope vulnerable to Server-Side Request Forgery

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function processaudioblock of the file src/agentscope/agent/agentbase.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +15 more potentially affected by CVE-2026-6606 via agentscope (>=1.0.5, <=1.0.18)

agentscope PYPI version =1.0.5, =1.0.0, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0.post1, =1.1.0a1, =1.0.2, =0.1.7, =0.0.0.1, =1.0.0.0, =1.0.0.2 and more Source cves: CVE-2026-6606 Source advisory: GHSA-CRX8-WPV6-JRJ2...

tashan-scispark (>=1.0.1, <=1.0.8) potentially affected by CVE-2026-6603 via agentscope (0.1.0)

agentscope PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2026-6603 Source advisory: OSV:GHSA-CR24-FV3H-8CJM...