Code Injection

AgentScope is vulnerable to Code Injection. The vulnerability is due to the eval function in the iscallableexpression function, which executes user-provided commands, allowing potential code injection...

PT-2024-39089 · Unknown · Modelscope/Agentscope

Name of the Vulnerable Software and Affected Versions: modelscope/agentscope version v0.0.4 Description: A Local File Inclusion LFI vulnerability exists in the "/load-workflow" endpoint, allowing an attacker to read arbitrary files from the server, including sensitive files such as API keys, by...

Eval Injection

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Eval Injection via the result = evals field of the iscallableexpression function in the agentscope\web\workstation\workflowutils.py file. An attacker can execute...

tashan-scispark (>=1.0.1 <=1.0.8) potentially affected by CVE-2024-48050 via agentscope (=0.1.0)

agentscope PYPI version =0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on agentscope and may be impacted: - tashan-scispark =1.0.1, =1.0.8 Source cves: CVE-2024-48050 Source advisory: OSV:GHSA-6P55-QR3J-MPGQ...

AgentScope uses `eval`

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

CVE-2024-48050

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

PYSEC-2024-262

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

CVE-2024-48050

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

PYSEC-2024-262

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

CVE-2024-48050

CVE-2024-48050 affects AgentScope

CVE-2024-48050

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

PT-2024-32970 · Unknown · Agentscope

Name of the Vulnerable Software and Affected Versions: agentscope versions 0.0.0 through 0.0.4 Description: The issue is related to the function is callable expression in the file agentscopewebworkstationworkflow utils.py. This function contains the line result = evals, which poses a security ris...

CVE-2024-48050

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

AgentScope 安全漏洞

AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version v0.0.4, which stems from the fact that the iscallableexpression function in the agentscopewebworkstationworkflowutils.py file can...