Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-8487CORS Vulnerability in modelscope/agentscope

High 7.4

In plain English

A high-severity security flaw in modelscope/agentscope from modelscope. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.0)7.4High

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the integrity and confidentiality of the system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	agentscope	no fix listed	GHSA-75v5-6885-59f9
PyPI	agentscope	no fix listed	PYSEC-2025-81

Affected products (as reported)

Vendor	Product	Versions
modelscope	modelscope/agentscope	unspecified – through latest

Weakness: CWE-346 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

https://huntr.com/bounties/7aca7507-a94e-4e63-83a2-15648e5c4067