- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 14 · 4 critical, 5 high, 5 medium
- Registry
- PyPI
Advisories 14
- CVE-2026-6606Medium 6.9
modelscope agentscope _agent_base.py _process_audio_block server-side request forgery
Affected: through 1.0.18.
- CVE-2026-6605Medium 6.9
modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery
Affected: through 1.0.18.
- CVE-2026-6604Medium 6.9
modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery
Affected: through 1.0.18.
- CVE-2026-6603Medium 6.9
modelscope agentscope _python.py execute_shell_command code injection
Affected: through 1.0.18.
- CVE-2024-8487High 7.4
CORS Vulnerability in modelscope/agentscope
Affected: through 0.0.4.
- CVE-2024-8556Medium 6.1
Stored XSS in modelscope/agentscope
Affected: through 0.1.1.
- CVE-2024-8524High 7.5
Directory Traversal in modelscope/agentscope
Affected: through 0.0.4.
- CVE-2024-8537Critical 9.1
Path Traversal in modelscope/agentscope
Affected: through 0.1.1.
- CVE-2024-8551Critical 9.1
Path Traversal in modelscope/agentscope
Affected: through 0.1.1.
- CVE-2024-8438High 7.5
Path Traversal in modelscope/agentscope
Affected: through 0.0.4.
- CVE-2024-8502Critical 9.8
Remote Code Execution via Deserialization in modelscope/agentscope
Affected: through 0.0.6a3.
- CVE-2024-8501High 7.5
Arbitrary File Download in modelscope/agentscope
Affected: through 0.0.4.
- CVE-2024-8550High 7.5
Local File Inclusion (LFI) in modelscope/agentscope
Affected: through 0.0.4.
- CVE-2024-48050Critical 9.8
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.
Affected: fixed in 0.0.5a1; through 0.1.0.