Modelscope CVE-2026-6604

The vulnerability requires that the AgentScope multi-modality OpenAI tools component is deployed and accessible to the attacker (network-reachable endpoint). No authentication is required (PR:N in CVSS). The vulnerability is triggered when an attacker provides a specially crafted image_url or audio_file_url parameter to the _parse_url, prepare_image, or openai_audio_to_text functions. These functions must be exposed via an API endpoint (HTTP/REST or similar). Default AgentScope deployments that include the multi-modality toolkit are affected unless the affected functions have been explicitly disabled or restricted via access controls. The vulnerability does NOT require special configuration, non-default settings, or user interaction - any instance with these functions enabled and network-accessible is exploitable.

CVSS 6.9 with AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation with no authentication or user interaction required. EPSS designation as 'E:P' (publicly available exploit) elevates practical risk beyond the base score. The low attack complexity (AC:L) and lack of authentication requirements (PR:N) make this readily exploitable by any remote attacker. While the CVSS impact scope is limited (VC:L/VI:L/VA:L with SC:N), the SSRF nature enables information disclosure of internal service responses, potential lateral movement to internal systems, and interaction with restricted endpoints. Real-world risk is significant because: (1) publicly available exploit code removes barriers to exploitation, (2) no vendor patch appears available despite early disclosure contact, and (3) SSRF vulnerabilities targeting cloud deployments frequently enable metadata endpoint abuse. The vulnerability is not listed as actively exploited in CISA KEV at publication time, but public PoC availability suggests imminent widespread scanning and targeted exploitation attempts.

An attacker sends a POST request to an AgentScope instance with a malicious image_url parameter pointing to an internal service, such as http://169.254.169.254/latest/meta-data (AWS metadata endpoint) or http://localhost:8080/admin/config. The vulnerable _parse_url or prepare_image function processes this URL without validation and makes a server-side HTTP request to fetch the resource. The attacker receives the response containing sensitive metadata, internal configuration, or credentials that the server can access, enabling further lateral movement or privilege escalation.