agentscopeGHSA-75v5-6885-59f9
AgentScope Cross-Origin Resource Sharing (CORS) vulnerability
High7.4CVE-2024-8487 · Published Mar 20, 2025 · updated Jun 5, 2026
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the integrity and confidentiality of the system.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| agentscope PyPI | <= 0.0.4 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-346
- Also known as
- CVE-2024-8487, PYSEC-2025-81
More agentscope advisories
All agentscope| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | AgentScope stored cross-site scripting (XSS) vulnerability Medium6.1Mar 20, 2025 | Medium6.1 | No fix yet |
| Mar 202025 | AgentScope directory traversal vulnerability in /read-examplesHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | AgentScope Deserialization VulnerabilityCritical9.8Mar 20, 2025 | Critical9.8 | No fix yet |
| Mar 202025 | AgentScope path traversal vulnerabilityCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | AgentScope Path Traversal in /api/fileHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | AgentScope path traversal vulnerability in save-workflowCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |