AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

agentscopeGHSA-p6h7-hfj2-vmcf

AgentScope arbitrary file download vulnerability in rpc_agent_client

agentscope

CVE-2024-8501 · Published Mar 20, 2025 · updated Jun 5, 2026

High7.5
No fix yet
GitHub advisory

An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network.

Affected versions

PackageAffectedFixed in
agentscope
PyPI
<= 0.0.4No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-36
Also known as
CVE-2024-8501, PYSEC-2025-82

More agentscope advisories

All agentscope