CVE-2024-8502

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

CVE-2024-8502 Remote Code Execution via Deserialization in modelscope/agentscope

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

CVE-2024-8489 CSRF due to overly permissive CORS headers in modelscope/agentscope

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery CSRF due to overly permissive CORS headers. This issue affects the latest commit on the main branch 21161fe. The vulnerability permits an attacker to access all...

CVE-2024-8489 CSRF due to overly permissive CORS headers in modelscope/agentscope

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery CSRF due to overly permissive CORS headers. This issue affects the latest commit on the main branch 21161fe. The vulnerability permits an attacker to access all...

CVE-2024-8489

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery CSRF due to overly permissive CORS headers. This issue affects the latest commit on the main branch 21161fe. The vulnerability permits an attacker to access all...

CVE-2024-8501 Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

CVE-2024-8501

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

CVE-2024-8501 Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive...

CVE-2024-8551: Relative Path Traversal

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of...

PT-2025-12231

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 21161fe Description A Cross-Site Request Forgery CSRF issue exists due to overly permissive CORS headers in the AgentScope Studio backend server. This allows an attacker to access all backend endpoints, including...

PT-2025-12229

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version v.0.0.4 Description A path traversal issue exists, allowing an attacker to read arbitrary files on the server due to improper sanitization of the path parameter in the /api/file API endpoint. Recommendations For...

PT-2025-12234

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 0.0.4 Description A directory traversal issue exists, allowing an attacker to read any local JSON file by sending a crafted POST request to the "/read-examples" endpoint. This enables the attacker to access...

CVE-2024-8524: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...

PT-2025-12230

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version v0.0.4 Description A Cross-Origin Resource Sharing CORS issue exists, where the CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain t...

PT-2025-12232

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version v0.0.4 Description An arbitrary file download issue exists in the rpc agent client component, allowing any user to download files from the rpc agent's host by exploiting the download file method. This can lead to...

PT-2025-12233

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 0.0.6a3 Description A vulnerability in the RpcAgentServerLauncher class allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the...

CVE-2024-8556: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string run ID is appended and rendered as HTML. This allows ...

PT-2025-12235

Name of the Vulnerable Software and Affected Versions modelscope/agentscope versions all Description The issue is related to a path traversal problem in the application. It is present in the "/delete-workflow" endpoint, which allows an attacker to delete arbitrary files from the filesystem. This...

CVE-2024-8537: Path Traversal: '\..\filename'

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling t...

CVE-2024-8502: Deserialization of Untrusted Data

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...