AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

agentscopeGHSA-6mf6-7j75-2m6f

AgentScope stored cross-site scripting (XSS) vulnerability

agentscope

CVE-2024-8556 · Published Mar 20, 2025 · updated Jul 7, 2026

Medium6.1
No fix yet
GitHub advisory

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

Affected versions

PackageAffectedFixed in
agentscope
PyPI
<= 0.1.1No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2024-8556, PYSEC-2026-1076

More agentscope advisories

All agentscope
High 7.5Mar 20, 2025AgentScope directory traversal vulnerability in /read-examplesCVE-2024-8524no fix yetHigh 7.4Mar 20, 2025AgentScope Cross-Origin Resource Sharing (CORS) vulnerabilityCVE-2024-8487no fix yetCritical 9.8Mar 20, 2025AgentScope Deserialization VulnerabilityCVE-2024-8502no fix yetCritical 9.1Mar 20, 2025AgentScope path traversal vulnerabilityCVE-2024-8537no fix yetHigh 7.5Mar 20, 2025AgentScope Path Traversal in /api/fileCVE-2024-8438no fix yetCritical 9.1Mar 20, 2025AgentScope path traversal vulnerability in save-workflowCVE-2024-8551no fix yet