122 matches found
CVE-2026-51851
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savetextfile. The savetextfile method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
PT-2026-132715
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file browser.py:FileBrowser.save text file. The save text file method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
CVE-2026-51851
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savetextfile. The savetextfile method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
EUVD-2026-113288
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savetextfile. The savetextfile method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
CVE-2026-51851: n/a: modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in…
modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savetextfile. The savetextfile method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
CVE-2026-51851
The software modelscope agent-zero versions 1.7, 1.8, 1.9, and 1.10 is vulnerable to a Directory Traversal vulnerability in the python/helpers/file_browser.py:FileBrowser.save_text_file method. The root cause is that the method accepts user-controlled file paths without performing any normalizati...
Agent Zero security vulnerability
Versions 1.7, 1.8, 1.9, and 1.10 of Agent Zero contain a security vulnerability. This vulnerability arises because the FileBrowser.savetextfile method accepts user-supplied file paths without any normalization or validation, potentially enabling path traversal attacks...
CVE-2026-97635
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
CVE-2026-97635
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
CVE-2026-97635
The Agent Zero Web UI versions prior to 1.15 are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of user-provided input in chat messages and file uploads . When the application reproduces content in the chat interface, injected JavaScript executes within the context of the v...
EUVD-2026-108272
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
CVE-2026-97635 Agent Zero Web UI XSS
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
CVE-2026-97635 Agent Zero Web UI XSS
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
AgentZero XSS
RISK EVALUATION The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI...
PT-2026-121494
The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface, any injected JavaScript is executed in the context of the victim’s authenticated Agent Zero Web UI session...
Agent Zero cross-site scripting vulnerability
Versions of Agent Zero Web UI prior to 1.15 contain a cross-site scripting vulnerability. This vulnerability arises from improper sanitization of user inputs in chat messages or file uploads, allowing injected JavaScript to execute within the context of an authenticated Agent Zero Web UI session...
CVE-2026-51852
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savefileb64. The savefileb64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
CVE-2026-51853
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...
CVE-2026-51852
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savefileb64. The savefileb64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...
CVE-2026-51853
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...