PT-2025-12232 · Unknown · Modelscope/Agentscope

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-8501

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version v0.0.4

Description An arbitrary file download issue exists in the rpc agent client component, allowing any user to download files from the rpc agent's host by exploiting the download file method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network.

Recommendations For modelscope/agentscope version v0.0.4, consider disabling the download file method in the rpc agent client component until a patch is available to prevent unauthorized file downloads. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2024-8501

GHSA-P6H7-HFJ2-VMCF

PYSEC-2025-82

Affected Products

Modelscope/Agentscope

References · 8

• 🔥 https://huntr.com/bounties/83e433c0-ed2d-4b10-8358-d3c1eee0a47c · Exploit
• https://osv.dev/vulnerability/PYSEC-2025-82 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8501 · Security Note
• https://osv.dev/vulnerability/GHSA-p6h7-hfj2-vmcf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8501 · Vendor Advisory
• https://github.com/modelscope/agentscope · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/agentscope/PYSEC-2025-82.yaml · Note
• https://twitter.com/CVEnew/status/1903336861579333917 · Twitter Post