All vulnerabilities
CVE-2024-8537GHSA-c4cc-w454-4634PYSEC-2026-254

AgentScope path traversal vulnerability

modelscope agentscopepipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Mar 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.04%Chance of exploitation activity in the next 30 days, higher than 63% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published20 Mar 2025Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.

Text from CVE List

Affected versions 13

  • agentscope, pip<= 0.1.1GitHub
  • modelscope/agentscopeaffected: unspecified through latestCVE List
  • agentscope, PyPIfrom first release, through 0.1.1OSV
  • agentscope, PyPI0.0.1OSV
  • agentscope, PyPI0.0.2OSV
  • agentscope, PyPI0.0.3OSV
  • agentscope, PyPI0.0.4OSV
  • agentscope, PyPI0.0.5OSV
  • agentscope, PyPI0.0.5a1OSV
  • agentscope, PyPI0.0.6a1OSV
  • agentscope, PyPI0.0.6a2OSV
  • agentscope, PyPI0.1.0OSV
  • agentscope, PyPI0.1.1OSV

References 8