253 matches found
AgentScope security vulnerabilities
AgentScope is an open-source application developed by ModelScope. It facilitates the simpler development of multi-agent applications based on LLMs. Versions of AgentScope prior to 1.0.18 contained a security vulnerability, which was caused by improper handling of parameters imageurl/audiofileurl ...
PT-2026-33709
Name of the Vulnerable Software and Affected Versions modelscope agentscope versions prior to 1.0.19 Description A code injection flaw exists that allows remote attackers to execute arbitrary code. The issue is located in the execute python code and execute shell command functions within the...
CVE-2026-6603: Improper Control of Generation of Code
A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function executepythoncode/executeshellcommand of the file src/AgentScope/tool/coding/python.py. This manipulation causes code injection. The attack is possible to be carried out remotely...
PT-2026-33710
Name of the Vulnerable Software and Affected Versions modelscope agentscope versions prior to 1.0.19 Description An issue exists in the Cloud Metadata Endpoint component within the file src/agentscope/tool/ multi modality/ openai tools.py. Specifically, the functions parse url, prepare image, and...
CVE-2026-6606: Server-Side Request Forgery (SSRF)
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function processaudioblock of the file src/agentscope/agent/agentbase.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack...
CVE-2026-6604: Server-Side Request Forgery (SSRF)
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parseurl/prepareimage/openaiaudiototext of the file src/agentscope/tool/multimodality/openaitools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...
MS-Agent vulnerable to Command Injection
A Command Injection vulnerability in ModelScope's MS-Agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
GHSA-4GC2-344Q-R2RW MS-Agent vulnerable to Command Injection
A Command Injection vulnerability in ModelScope's MS-Agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
EUVD-2026-9257
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256
ModelScope's MS-Agent (specifically version v1.5.2 and earlier, including v1.6.0rc1 ) is vulnerable to a command injection flaw in its Shell tool component. The root cause is the improper sanitization of user-influenced input, which is passed directly to a shell execution context at ms_agent/tool...
CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
PT-2026-22697
Name of the Vulnerable Software and Affected Versions ModelScope ms-agent versions prior to v1.6.0rc1 Description A command injection issue exists in the ModelScope ms-agent framework, specifically within the Shell tool, due to improper input sanitization. The regular expression-based blacklist...
MS-Agent security vulnerability
MS-Agent is an open-source personal assistant framework developed by ModelScope. Versions of MS-Agent prior to v1.6.0rc1 contained security vulnerabilities. These vulnerabilities stemmed from specially crafted prompt inputs that could lead to command injection, allowing execution of arbitrary...
CVE-2026-2256: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input...
modelscope (>=1.9.0, <=1.9.1), scepter (>=0.0.1, <=1.0.3) potentially affected by CVE-2025-41419 via ms-swift (>=1.3.0, <=2.2.5)
ms-swift PYPI version =1.3.0, =1.9.0, =0.0.1, =1.0.3 Source cves: CVE-2025-41419 Source advisory: MEND:CVE-2025-41419...