Modelscope CVE-2026-6605

The _get_bytes_from_web_url function must be accessible to untrusted input (either directly via an API endpoint, command-line argument, or configuration parameter that can be manipulated by an attacker). The vulnerability requires no authentication (CVSS PR:N) and no user interaction (CVSS UI:N), meaning any network path to the function is exploitable. Exploitation is limited by network policies: if the AgentScope server has firewall rules blocking outbound connections or cannot reach internal services, the attacker's ability to exfiltrate sensitive data is constrained, though the SSRF itself still succeeds. The attack is not limited by default configuration - standard AgentScope deployments with no additional security hardening are exploitable. No CVE-specific platform or OS constraints are documented; the vulnerability affects AgentScope on any supported platform (Linux, Windows, macOS) where the Python component is executed.

CVSS 6.9 (Network/Low Complexity/No Privileges/No User Interaction required) indicates network-accessible SSRF with low attack complexity. The vector shows partial confidentiality, integrity, and availability impacts (VC:L/VI:L/VA:L) without scope change, suggesting attackers can read internal resources or interact with backend services but cannot escalate to full system compromise from this flaw alone. EPSS score is not provided, limiting exploitation probability assessment. However, the combination of public exploit availability (E:P), network vector (AV:N), and SSRF's high real-world utility for lateral movement and credential theft elevates practical risk beyond the moderate CVSS score. The vendor's non-response to disclosure is a significant signal that no patch timeline exists, leaving organizations unable to rely on an upstream fix. The low complexity and lack of authentication requirements mean any internet-connected AgentScope instance is exploitable. Real-world risk hinges on deployment context: if AgentScope is deployed in isolated environments with no internal network access from the server, risk is lower; if it runs in cloud or corporate networks with access to internal services (databases, cloud metadata endpoints, other microservices), risk is significantly higher for lateral movement attacks.

An attacker sends a crafted request to an internet-facing AgentScope instance, specifying a malicious URL to the _get_bytes_from_web_url function (e.g., via an API endpoint that accepts URL parameters). The function processes the URL without validation and makes an HTTP request from the server, allowing the attacker to access internal services such as cloud metadata endpoints to steal credentials, enumerate internal APIs on RFC 1918 networks, or interact with backend databases that trust connections from the application server. Publicly available exploit code on GitHub (YLChen-007 gist) demonstrates the attack, lowering the barrier for opportunistic exploitation.