EUVD-2026-23773Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8Blast Radius
ecosystem impact- 7 pypi packages depend on agentscope (6 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.0.18.
DescriptionCVE.org
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate image_url and audio_file_url parameters in the _parse_url, prepare_image, and openai_audio_to_text functions, enabling arbitrary HTTP requests from the affected server. The vulnerability has publicly available exploit code and affects the Cloud Metadata Endpoint component. The vendor has not responded to early disclosure attempts, and exploitation is confirmed to be possible with low attack complexity.
Technical ContextAI
The vulnerability exists in src/agentscope/tool/_multi_modality/_openai_tools.py where URL parameters (image_url and audio_file_url) are processed without proper validation before being used in server-side HTTP requests. This is a classic SSRF vulnerability (CWE-918) where user-controlled input is directly used to construct URLs for backend server requests. The affected functions (_parse_url, prepare_image, openai_audio_to_text) are part of AgentScope's multi-modality toolkit designed to handle OpenAI audio and image processing via cloud endpoints. By manipulating these URL parameters, an attacker can cause the server to make requests to arbitrary destinations, including internal networks, metadata services, or other restricted resources that the server has access to.
RemediationAI
Upgrade AgentScope to a version newer than 1.0.18 if a patched release becomes available from the ModelScope project. Until a vendor patch is released, implement the following compensating controls: (1) Restrict network access to the OpenAI tools endpoints using firewall rules or API gateway policies - allow only trusted internal services to invoke _parse_url, prepare_image, and openai_audio_to_text functions; (2) Implement strict URL validation and whitelisting in the application layer - validate that image_url and audio_file_url parameters match an allowlist of trusted domains (e.g., OpenAI CDN, specific customer domains) before processing; (3) Use a network-level outbound proxy with restrictive rules to prevent the server from accessing internal metadata endpoints (169.254.169.254), private RFC1918 ranges, and loopback addresses; (4) Deploy rate limiting and request logging on these endpoints to detect anomalous URL patterns indicative of SSRF exploitation attempts. Each control has tradeoffs: whitelisting may limit legitimate use cases and require maintenance; outbound filtering may impact legitimate multi-modal features if they require external resource fetching. Monitor the ModelScope GitHub repository and security advisories for patched releases.
More in Agentscope
View allIn agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. R
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. Rated critical s
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope vers
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. Rated high severity (CVSS 7.5), this
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. Rated high severity (CVSS 7.5), this vul
Remote code execution in ModelScope AgentScope up to version 1.0.18 allows unauthenticated network attackers to inject a
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_a
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to man
Unauthenticated path traversal in AgentScope through 2.0.7.post1 allows remote attackers to copy arbitrary server-side d
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on th
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. Rated critical seve
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today