EUVD-2026-23774Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8Blast Radius
ecosystem impact- 7 pypi packages depend on agentscope (6 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.0.18.
DescriptionCVE.org
A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/_common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate the _get_bytes_from_web_url function in src/agentscope/_utils/_common.py, enabling them to make arbitrary HTTP requests from the affected server. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts, leaving affected installations vulnerable to attackers probing internal networks and services.
Technical ContextAI
The vulnerability exists in AgentScope's internal URL fetching utility, specifically the _get_bytes_from_web_url function which likely uses HTTP client libraries (such as requests or urllib) without proper URL validation or host filtering. CWE-918 (Server-Side Request Forgery) indicates insufficient input sanitization on URLs passed to web request functions. The component is classified as an Internal Service, suggesting it is used by other AgentScope modules to fetch remote content. CPE data identifies AgentScope as the affected product across all versions up to and including 1.0.18, with no version constraint specified in the vulnerability record, implying all documented versions below 1.0.18 are affected.
RemediationAI
No vendor-released patch identified at time of analysis; the vendor did not respond to early disclosure. Immediate mitigation requires upgrading AgentScope to a version newer than 1.0.18 if one becomes available, but no confirmed patched version exists in current records. Compensating controls include: (1) Restrict network access to AgentScope servers by implementing firewall rules that block outbound HTTP/HTTPS traffic from AgentScope hosts except to explicitly whitelisted external domains and services - verify that AgentScope's legitimate use cases are not blocked; (2) Deploy egress filtering at the network boundary to prevent internal metadata service access (e.g., AWS 169.254.169.254, Azure 168.63.129.16, GCP metadata endpoints) from AgentScope processes - this prevents credential harvesting but may affect cloud-native deployments; (3) Run AgentScope in an isolated network segment without direct access to internal databases, APIs, or sensitive services - this reduces the value of SSRF but requires architectural changes; (4) Implement request inspection and validation at the application level by forking AgentScope and adding URL scheme validation (whitelist http/https only), IP address filtering (block RFC 1918 private ranges and loopback), and hostname resolution validation (prevent DNS rebinding) - this requires custom development and ongoing maintenance. Monitor vendor channels and security bulletins for a patched version release.
More in Agentscope
View allIn agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. R
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. Rated critical s
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope vers
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. Rated high severity (CVSS 7.5), this
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. Rated high severity (CVSS 7.5), this vul
Remote code execution in ModelScope AgentScope up to version 1.0.18 allows unauthenticated network attackers to inject a
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_a
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on th
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. Rated critical seve
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today