Modelscope

Agentscope

15 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.1

CVE-2024-8551

Exploit
  • EPSS 0.95%
  • Veröffentlicht 20.03.2025 10:10:21
  • Zuletzt bearbeitet 01.08.2025 12:44:30

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially...

7.5

CVE-2024-8438

Exploit
  • EPSS 0.74%
  • Veröffentlicht 20.03.2025 10:09:49
  • Zuletzt bearbeitet 01.08.2025 01:49:54

A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.

8.8

CVE-2024-8501

Exploit
  • EPSS 0.99%
  • Veröffentlicht 20.03.2025 10:08:44
  • Zuletzt bearbeitet 01.04.2025 20:31:58

An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This ...

7.5

CVE-2024-8550

Exploit
  • EPSS 0.51%
  • Veröffentlicht 10.02.2025 19:15:39
  • Zuletzt bearbeitet 30.07.2025 01:02:10

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by ma...

9.8

CVE-2024-48050

Exploit
  • EPSS 0.81%
  • Veröffentlicht 04.11.2024 23:15:04
  • Zuletzt bearbeitet 04.09.2025 16:26:54

In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.