CVE-2026-10801 | Low | 3.6 | 2026-06-04 | A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/ba… |
CVE-2026-6606 | High | 7.3 | 2026-04-20 | A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/a… |
CVE-2026-6605 | High | 7.3 | 2026-04-20 | A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/… |
CVE-2026-6604 | High | 7.3 | 2026-04-20 | A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of t… |
CVE-2026-6603 | High | 7.3 | 2026-04-20 | A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command… |
CVE-2026-2256 | Medium | 6.5 | 2026-03-02 | A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system co… |
CVE-2024-8556 | Medium | 6.1 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs… |
CVE-2024-8551 | Critical | 9.1 | 2025-03-20 | A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerabili… |
CVE-2024-8537 | Critical | 9.1 | 2025-03-20 | A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow en… |
CVE-2024-8524 | High | 7.5 | 2025-03-20 | A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by se… |
CVE-2024-8502 | Critical | 9.8 | 2025-03-20 | A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted d… |
CVE-2024-8501 | High | 8.8 | 2025-03-20 | An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user t… |
CVE-2024-8489 | High | 8.8 | 2025-03-20 | A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly perm… |
CVE-2024-8487 | Critical | 9.8 | 2025-03-20 | A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not p… |
CVE-2024-8438 | High | 7.5 | 2025-03-20 | A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, a… |
CVE-2024-8550 | High | 7.5 | 2025-02-10 | A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker… |
CVE-2024-48050 | Critical | 9.8 | 2024-11-04 | In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result =… |