Agentscope
Monthly
Path traversal in ModelScope AgentScope 1.0.0 through 1.0.8 allows an attacker who can reach the built-in insert_text_file tool and influence its path or filename argument to read and write files outside the intended workspace directory, giving both high confidentiality and high integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The attacker is not anonymous: exploitation requires at least low-privilege access to the agent or tool surface (PR:L), typically via a direct agent tool call, an exposed agent API endpoint, or prompt injection through untrusted content the agent processes, and the reachable damage is bounded by the filesystem permissions of the AgentScope process user. No confirmed active exploitation exists (not listed in CISA KEV) and no public exploit was identified at the time of analysis, so this should be treated as a real but conditional risk that depends on whether insert_text_file is enabled, exposed, and influenceable by an untrusted party.
Path traversal in AgentScope 1.0.0 through 1.0.18 lets an attacker who can influence the path argument passed to the agent's write_text_file tool cause file writes outside the intended directory, resulting in arbitrary file overwrite on the host running the agent. The assessed CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), reflecting a network-reachable, low-complexity issue that requires the attacker to hold low privileges relative to the agent (PR:L) while the primary impact is integrity, with limited availability impact and no confirmed confidentiality impact. Exploitation is realistic in deployments where the agent is wired to call write_text_file with attacker-influenceable paths, most plausibly via untrusted content processed by the agent (indirect prompt injection) or a malicious task submitted to it; no public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in AgentScope 1.0.18 and 1.0.19 allows remote attackers to execute arbitrary Python in the service environment: when a RealtimeAgent session has execute_python_code registered as an available tool, the agent's _acting path forwards a model-produced tool call straight to Toolkit.call_tool_function with no approval prompt and no sandbox boundary, so a remote WebSocket user who can reach the endpoint and steer the agent can obtain code execution with the service's privileges. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) no authentication is required, and the SSVC assessment records that publicly available exploit code exists (exploitation: poc), so the vulnerability is automatable with total technical impact; EPSS is low at 0.20% (9th percentile), indicating limited observed exploitation activity so far. Exploitation is conditional on the deployment exposing the execute_python_code tool in a RealtimeAgent session and on the WebSocket interface being network-reachable - instances that do not register that tool are not vulnerable via this path.
Unauthenticated path traversal in AgentScope through 2.0.7.post1 allows remote attackers to copy arbitrary server-side directories into the agent workspace via the unvalidated skill_path parameter in LocalWorkspace.add_skill, exposing sensitive server files through the workspace skill listing API. The affected function performs no confinement of the source path, enabling directory traversal to any filesystem location readable by the server process. No patch has been confirmed at time of analysis; CVSS 4.0 rates this 8.7 with no privileges or user interaction required.
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_audio_block function that allows remote unauthenticated attackers to manipulate the 'url' argument and trigger arbitrary HTTP requests from the vulnerable server. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected deployments without an official patch.
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate the _get_bytes_from_web_url function in src/agentscope/_utils/_common.py, enabling them to make arbitrary HTTP requests from the affected server. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts, leaving affected installations vulnerable to attackers probing internal networks and services.
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate image_url and audio_file_url parameters in the _parse_url, prepare_image, and openai_audio_to_text functions, enabling arbitrary HTTP requests from the affected server. The vulnerability has publicly available exploit code and affects the Cloud Metadata Endpoint component. The vendor has not responded to early disclosure attempts, and exploitation is confirmed to be possible with low attack complexity.
Remote code execution in ModelScope AgentScope up to version 1.0.18 allows unauthenticated network attackers to inject and execute arbitrary Python code or shell commands through the execute_python_code and execute_shell_command functions in src/AgentScope/tool/_coding/_python.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications, leaving all versions up to 1.0.18 unpatched and actively exploitable.
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in ModelScope AgentScope 1.0.0 through 1.0.8 allows an attacker who can reach the built-in insert_text_file tool and influence its path or filename argument to read and write files outside the intended workspace directory, giving both high confidentiality and high integrity impact (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The attacker is not anonymous: exploitation requires at least low-privilege access to the agent or tool surface (PR:L), typically via a direct agent tool call, an exposed agent API endpoint, or prompt injection through untrusted content the agent processes, and the reachable damage is bounded by the filesystem permissions of the AgentScope process user. No confirmed active exploitation exists (not listed in CISA KEV) and no public exploit was identified at the time of analysis, so this should be treated as a real but conditional risk that depends on whether insert_text_file is enabled, exposed, and influenceable by an untrusted party.
Path traversal in AgentScope 1.0.0 through 1.0.18 lets an attacker who can influence the path argument passed to the agent's write_text_file tool cause file writes outside the intended directory, resulting in arbitrary file overwrite on the host running the agent. The assessed CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), reflecting a network-reachable, low-complexity issue that requires the attacker to hold low privileges relative to the agent (PR:L) while the primary impact is integrity, with limited availability impact and no confirmed confidentiality impact. Exploitation is realistic in deployments where the agent is wired to call write_text_file with attacker-influenceable paths, most plausibly via untrusted content processed by the agent (indirect prompt injection) or a malicious task submitted to it; no public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote code execution in AgentScope 1.0.18 and 1.0.19 allows remote attackers to execute arbitrary Python in the service environment: when a RealtimeAgent session has execute_python_code registered as an available tool, the agent's _acting path forwards a model-produced tool call straight to Toolkit.call_tool_function with no approval prompt and no sandbox boundary, so a remote WebSocket user who can reach the endpoint and steer the agent can obtain code execution with the service's privileges. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) no authentication is required, and the SSVC assessment records that publicly available exploit code exists (exploitation: poc), so the vulnerability is automatable with total technical impact; EPSS is low at 0.20% (9th percentile), indicating limited observed exploitation activity so far. Exploitation is conditional on the deployment exposing the execute_python_code tool in a RealtimeAgent session and on the WebSocket interface being network-reachable - instances that do not register that tool are not vulnerable via this path.
Unauthenticated path traversal in AgentScope through 2.0.7.post1 allows remote attackers to copy arbitrary server-side directories into the agent workspace via the unvalidated skill_path parameter in LocalWorkspace.add_skill, exposing sensitive server files through the workspace skill listing API. The affected function performs no confinement of the source path, enabling directory traversal to any filesystem location readable by the server process. No patch has been confirmed at time of analysis; CVSS 4.0 rates this 8.7 with no privileges or user interaction required.
Modelscope AgentScope versions up to 1.0.18 contain a server-side request forgery (SSRF) vulnerability in the _process_audio_block function that allows remote unauthenticated attackers to manipulate the 'url' argument and trigger arbitrary HTTP requests from the vulnerable server. Publicly available exploit code exists, and the vendor has not responded to disclosure attempts, leaving affected deployments without an official patch.
Server-side request forgery in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate the _get_bytes_from_web_url function in src/agentscope/_utils/_common.py, enabling them to make arbitrary HTTP requests from the affected server. Publicly available exploit code exists, and the vendor has not responded to early disclosure attempts, leaving affected installations vulnerable to attackers probing internal networks and services.
Server-side request forgery (SSRF) in ModelScope AgentScope up to version 1.0.18 allows remote unauthenticated attackers to manipulate image_url and audio_file_url parameters in the _parse_url, prepare_image, and openai_audio_to_text functions, enabling arbitrary HTTP requests from the affected server. The vulnerability has publicly available exploit code and affects the Cloud Metadata Endpoint component. The vendor has not responded to early disclosure attempts, and exploitation is confirmed to be possible with low attack complexity.
Remote code execution in ModelScope AgentScope up to version 1.0.18 allows unauthenticated network attackers to inject and execute arbitrary Python code or shell commands through the execute_python_code and execute_shell_command functions in src/AgentScope/tool/_coding/_python.py. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications, leaving all versions up to 1.0.18 unpatched and actively exploitable.
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.