GitHub Advisoryadvisory · PyPI
GHSA-c4cc-w454-4634 AgentScope path traversal vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2024-8537
- Ecosystem
- PyPI
- Packages
- agentscope
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-22, CWE-29
- Reviewed
- 2025-03-20
Affected packages
• PyPI agentscope: <= 0.1.1 (no fix yet)
Description
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
Related
Alias · CVE (1)
- CVE-2024-8537 A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8537 advisory
- https://github.com/modelscope/agentscope/pull/459 web
- https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a web
- https://github.com/modelscope/agentscope package
- https://github.com/modelscope/agentscope/blob/01530ee6a99c86426aab1be11ec3b3b86ca640ac/src/agentscope/studio/_app.py#L743 web
- https://github.com/pypa/advisory-database/tree/main/vulns/agentscope/PYSEC-2026-254.yaml web
- https://huntr.com/bounties/eeb8aa4b-e6e5-465c-b0dd-aa97e3b7dc09 web
- https://pypi.org/project/agentscope web