Medium

AgentScope stored cross-site scripting (XSS) vulnerability

Disclosed: 20.03.2025
Updated: 11.10.2026 13:18

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Python (PyPI)	agentscope	<= 0.1.1	no fix

References

CVSS score 6.1/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Platform: Python (PyPI)
Package: agentscope
Disclosed: 20.03.2025
Updated: 11.10.2026 13:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-1076 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-6mf6-7j75-2m6f - CC BY 4.0

Vulnerability history: agentscope

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (14) in the archive

Total entries: 14
First → latest: 11.2024 04.2026
Without a fix: 13
Exploited in attacks: 0

Severity breakdown

Critical 5
High 4
Medium 5

Disclosures per year

2024: 1
2025: 9
2026: 4

20.03.2025

AgentScope stored cross-site scripting (XSS) vulnerability this entry

Medium · 6.1 CVE-2024-8556 <= 0.1.1 no fix
20.03.2025

AgentScope path traversal vulnerability

Critical · 9.1 CVE-2024-8537 <= 0.1.1 no fix
20.03.2025

AgentScope path traversal vulnerability in save-workflow

Critical · 9.1 CVE-2024-8551 <= 0.1.1 no fix
20.03.2025

AgentScope Deserialization Vulnerability

Critical · 9.8 CVE-2024-8502 <= 0.0.6a3 no fix
20.03.2025

An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's

High · 8.8 CVE-2024-8501 <= 0.0.4 no fix
20.03.2025

A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary fil

High · 7.5 CVE-2024-8438 <= 0.0.4 no fix
20.03.2025

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read

High · 7.5 CVE-2024-8524 <= 0.0.4 no fix
20.03.2025

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted o

Critical · 9.8 CVE-2024-8487 <= 0.0.4 no fix
10.02.2025

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server,

High · 7.5 CVE-2024-8550 <= 0.0.4 no fix
04.11.2024

In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can d

Critical · 9.8 CVE-2024-48050 < 0.0.5a1 0.0.5a1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application