AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

agentscopeGHSA-9w5h-67gf-xvv8

AgentScope Deserialization Vulnerability

agentscope

CVE-2024-8502 · Published Mar 20, 2025 · updated Oct 26, 2026

Critical9.8
No fix yet
GitHub advisory

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.

Affected versions

PackageAffectedFixed in
agentscope
PyPI
<= 0.0.6a3No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-502
Also known as
CVE-2024-8502, PYSEC-2026-253

More agentscope advisories

All agentscope
Medium 6.1Mar 20, 2025AgentScope stored cross-site scripting (XSS) vulnerabilityCVE-2024-8556no fix yetHigh 7.5Mar 20, 2025AgentScope directory traversal vulnerability in /read-examplesCVE-2024-8524no fix yetHigh 7.4Mar 20, 2025AgentScope Cross-Origin Resource Sharing (CORS) vulnerabilityCVE-2024-8487no fix yetCritical 9.1Mar 20, 2025AgentScope path traversal vulnerabilityCVE-2024-8537no fix yetHigh 7.5Mar 20, 2025AgentScope Path Traversal in /api/fileCVE-2024-8438no fix yetCritical 9.1Mar 20, 2025AgentScope path traversal vulnerability in save-workflowCVE-2024-8551no fix yet