p PatchFirst

CVE-2024-8551

CVE-2024-8551 · Path Traversal in modelscope/agentscope

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

CVSS 9.1 · Critical · EPSS 1.0%

Published
Updated

Stack: python

Affected products and versions

  • modelscope/agentscope

    Versions
    • ≥ unspecified, ≤ latest: Affected (custom)

    No fix published

  • agentscope PyPI

    Versions
    • 0.0.1
    • 0.0.2
    • 0.0.3
    • 0.0.4
    • 0.0.5
    • 0.0.5a1
    • 0.0.6a1
    • 0.0.6a2
    • 0.1.0
    • 0.1.1
    Affected ranges
    • ECOSYSTEM: ≤ 0.1.1

    No fix published

Original sources

Check your server →