Agentscope
Approved changes feed: RSS · Atom
cpe:2.3:a:modelscope:agentscope:0.0.4:*:*:*:*:*:*:*
part: a version: 0.0.4 update: *
| Vendor | Modelscope (ee5b65ac-88d3-5ffb-9832-709cef7395c8) |
|---|---|
| Product | Agentscope (c6242888-9667-5cf3-b73a-5283455bdc8a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/modelscope/agentscope |
purl2cpe | 2026-06-01 10:15:35.207894 |
pkg:pypi/agentscope |
purl2cpe | 2026-07-28 16:41:07.410075 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-8550 |
vulnerable | 2026-06-08 07:00:24.924869 |
Local File Inclusion (LFI) in modelscope/agentscope
HIGH (7.5)
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.
Published: 2025-02-10T18:50:01.038Z
Updated: 2025-02-10T23:20:32.284Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8524 |
vulnerable | 2026-06-08 07:00:24.849413 |
Directory Traversal in modelscope/agentscope
HIGH (7.5)
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.
Published: 2025-03-20T10:11:18.458Z
Updated: 2025-10-15T12:50:40.766Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8501 |
vulnerable | 2026-06-08 07:00:24.798751 |
Arbitrary File Download in modelscope/agentscope
HIGH (7.5)
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network.
Published: 2025-03-20T10:08:44.723Z
Updated: 2025-03-20T14:46:18.305Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8487 |
vulnerable | 2026-06-08 07:00:24.753669 |
CORS Vulnerability in modelscope/agentscope
HIGH (7.4)
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the integrity and confidentiality of the system.
Published: 2025-03-20T10:11:26.563Z
Updated: 2025-03-20T13:04:47.063Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8438 |
vulnerable | 2026-06-08 07:00:24.641780 |
Path Traversal in modelscope/agentscope
HIGH (7.5)
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.
Published: 2025-03-20T10:09:49.971Z
Updated: 2025-03-20T18:34:01.364Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.