Agentscope (Modelscope) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 22 known versions, newest CVE from 2026-04-20. Vendor: Modelscope.
CVEs of Agentscope
- CVE-2026-6605 - CVSS 7.3 (high), 2026-04-20: A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file…
- CVE-2026-6604 - CVSS 7.3 (high), 2026-04-20: A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of…
- CVE-2026-6603 - CVSS 7.3 (high), 2026-04-20: A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command…
- CVE-2026-6606 - CVSS 7.3 (high), 2026-04-20: A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file…
- CVE-2024-8556 - CVSS 6.1 (medium), 2025-03-20: A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability…
- CVE-2024-8551 - CVSS 9.1 (critical), 2025-03-20: A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This…
- CVE-2024-8438 - CVSS 7.5 (high), 2025-03-20: A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter,…
- CVE-2024-8524 - CVSS 7.5 (high), 2025-03-20: A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by…
- CVE-2024-8501 - CVSS 8.8 (high), 2025-03-20: An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user…
- CVE-2024-8487 - CVSS 9.8 (critical), 2025-03-20: A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not…
- CVE-2024-8537 - CVSS 9.1 (critical), 2025-03-20: A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow…
- CVE-2024-8550 - CVSS 7.5 (high), 2025-02-10: A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an…
- CVE-2024-48050 - CVSS 9.8 (critical), 2024-11-04: In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result =…
