All vulnerabilities
CVE-2024-8551GHSA-j9rw-qm5f-r8xmPYSEC-2026-255

AgentScope path traversal vulnerability in save-workflow

modelscope agentscopepipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Mar 2025. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)1.02%Chance of exploitation activity in the next 30 days, higher than 63% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published20 Mar 2025Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

Text from CVE List

Affected versions 13

  • agentscope, pip<= 0.1.1GitHub
  • modelscope/agentscopeaffected: unspecified through latestCVE List
  • agentscope, PyPIfrom first release, through 0.1.1OSV
  • agentscope, PyPI0.0.1OSV
  • agentscope, PyPI0.0.2OSV
  • agentscope, PyPI0.0.3OSV
  • agentscope, PyPI0.0.4OSV
  • agentscope, PyPI0.0.5OSV
  • agentscope, PyPI0.0.5a1OSV
  • agentscope, PyPI0.0.6a1OSV
  • agentscope, PyPI0.0.6a2OSV
  • agentscope, PyPI0.1.0OSV
  • agentscope, PyPI0.1.1OSV

References 6