EUVD-2026-23777Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8Blast Radius
ecosystem impact- 7 pypi packages depend on agentscope (6 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.0.18.
DescriptionCVE.org
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_audio_block function that allows remote unauthenticated attackers to manipulate the 'url' argument and trigger arbitrary HTTP requests from the vulnerable server. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected deployments without an official patch.
Technical ContextAI
The vulnerability resides in the audio processing pipeline of AgentScope, specifically the _process_audio_block function in src/agentscope/agent/_agent_base.py. The root cause is improper input validation of the 'url' parameter (CWE-918: Server-Side Request Forgery), which allows attackers to craft malicious URL arguments that cause the application to make unintended HTTP requests to attacker-controlled or internal endpoints. AgentScope is a multi-agent framework built on Python that processes various data types including audio; the vulnerable code path processes audio blocks without sufficient URL sanitization. The CPE designation (cpe:2.3:a:modelscope:agentscope:*) indicates all versions up to and including 1.0.18 are affected, with no explicit upper-bound version limiting the vulnerability scope.
RemediationAI
No vendor-released patch has been identified. Given the vendor's non-response to disclosure and lack of official security updates, the primary mitigation strategies are: (1) Upgrade to AgentScope version beyond 1.0.18 if available from alternative sources or wait for community-maintained forks; (2) If upgrade is not possible, disable or restrict the _process_audio_block function entirely if audio processing is not required for your use case; (3) Implement strict network-level controls by restricting outbound HTTP/HTTPS requests from the AgentScope application to a whitelist of known-good destinations only, using firewall rules or iptables; (4) Place AgentScope behind a proxy or WAF that validates and sanitizes URL parameters passed to the audio processing endpoint, blocking requests with suspicious URL schemes (file://, gopher://, etc.) or internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1); (5) Isolate the AgentScope deployment in a network segment with minimal access to internal services and cloud metadata endpoints. Monitor outbound connections from the application for anomalous HTTP requests. Reference the public exploit at https://gist.github.com/YLChen-007/4e589eec07446726612dc416a7d80820 and VulDB disclosure at https://vuldb.com/vuln/358241 for additional context.
More in Agentscope
View allIn agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. R
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. Rated critical s
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope vers
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. Rated high severity (CVSS 7.5), this
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. Rated high severity (CVSS 7.5), this vul
Remote code execution in ModelScope AgentScope up to version 1.0.18 allows unauthenticated network attackers to inject a
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to man
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on th
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. Rated critical seve
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today