Vulnerabilities

TI-2024-07869 CVE-2024-8487 · GHSA-75v5-6885-59f9

CORS Vulnerability in modelscope/agentscope

HIGH 75

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00295 Published 2025-03-20 No fix listed CWE-346

TI-2024-07932 CVE-2024-8556 · GHSA-6mf6-7j75-2m6f

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00425 Published 2025-03-20 No fix listed CWE-79

TI-2024-07902 CVE-2024-8524 · GHSA-6v28-q95m-93qr

HIGH 72

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01186 Published 2025-03-20 No fix listed CWE-22

TI-2024-07914 CVE-2024-8537 · GHSA-c4cc-w454-4634

HIGH 78

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0104 Published 2025-03-20 No fix listed CWE-29

TI-2024-07927 CVE-2024-8551 · GHSA-j9rw-qm5f-r8xm

HIGH 78

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01022 Published 2025-03-20 No fix listed CWE-23

TI-2024-07822 CVE-2024-8438 · GHSA-f4hc-q562-cc5r

HIGH 72

A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00772 Published 2025-03-20 No fix listed CWE-22

TI-2024-07881 CVE-2024-8501 · GHSA-p6h7-hfj2-vmcf

HIGH 77

An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01022 Published 2025-03-20 No fix listed CWE-36

TI-2024-07926 CVE-2024-8550 · GHSA-mrm5-rxf8-grcc

HIGH 72

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0052 Published 2025-02-10 No fix listed CWE-497

TI-2024-32252 CVE-2024-48050 · GHSA-6p55-qr3j-mpgq

HIGH 82

In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00811 Published 2024-11-04 No fix listed CWE-94