ModelScope AgentScope EUVD-2026-90427

Requires a running instance of ModelScope AgentScope version 1.0.0 through 1.0.8 where the built-in insert_text_file file tool is reachable and its path/filename argument can be influenced by the attacker (typically via an agent tool call, an exposed agent API, or prompt injection through untrusted content the agent processes). Exploitation is limited by: the need for at least low-privilege access to the agent/tool surface (PR:L) rather than pure anonymous access; network reachability of the agent service for AV:N to hold; and the traversal being confined to files the AgentScope process user can read/write. No user interaction is required (UI:N), and default configurations of the affected versions are vulnerable where the tool is enabled.

Signals are mixed and point to a real but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 High) describes a low-complexity, network-reachable flaw requiring only low privileges and no user interaction, with high confidentiality and integrity impact - consistent with an arbitrary file read/write via path traversal in AgentScope's built-in insert_text_file tool. However, no EPSS score, no CISA KEV listing, and no vendor-confirmed POC flag are present in the input, so there is no evidence of active or automated exploitation; the sole reference is a third-party GitHub gist (by 'Ro1ME') that likely contains the disclosure/technical detail but is not marked as a weaponized exploit. The PR:L rating is the key nuance: AgentScope is a developer framework, and insert_text_file is a tool the LLM agent invokes, so 'exploitation' typically means an attacker who can influence agent inputs (e.g., via prompt injection or an authenticated API/tool call) rather than a fully unauthenticated internet attacker - the network AV:N holds only when the agent service is exposed. Net: a legitimately high-impact bug worth patching promptly for anyone running the affected versions, but not a mass-exploitation emergency given the niche footprint and absence of KEV/EPSS/POC evidence.

An attacker who can control input to an AgentScope agent (for example through prompt injection in untrusted content, or by calling an exposed agent/tool endpoint with low-privilege access) supplies a file path containing traversal sequences (e.g., ../../) to the insert_text_file tool. Because the path is not confined to the intended working directory, the agent reads or writes files outside it - overwriting configuration, source, or secret files (or disclosing their contents), potentially escalating to code execution. No public weaponized exploit is confirmed in the input, though the referenced gist likely documents the technical details.