agentscopeGHSA-j9rw-qm5f-r8xm
AgentScope path traversal vulnerability in save-workflow
Critical9.1CVE-2024-8551 · Published Mar 20, 2025 · updated Jun 29, 2026
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| agentscope PyPI | <= 0.1.1 | No fix yet |
Details and references
More agentscope advisories
All agentscope| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | AgentScope stored cross-site scripting (XSS) vulnerability Medium6.1Mar 20, 2025 | Medium6.1 | No fix yet |
| Mar 202025 | AgentScope directory traversal vulnerability in /read-examplesHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | AgentScope Cross-Origin Resource Sharing (CORS) vulnerabilityHigh7.4Mar 20, 2025 | High7.4 | No fix yet |
| Mar 202025 | AgentScope Deserialization VulnerabilityCritical9.8Mar 20, 2025 | Critical9.8 | No fix yet |
| Mar 202025 | AgentScope path traversal vulnerabilityCritical9.1Mar 20, 2025 | Critical9.1 | No fix yet |
| Mar 202025 | AgentScope Path Traversal in /api/fileHigh7.5Mar 20, 2025 | High7.5 | No fix yet |