Vulnerability · Published Feb 10, 2025 · Assigned by @huntr_ai
CVE-2024-8550Local File Inclusion (LFI) in modelscope/agentscope
High 7.5
In plain English
A high-severity security flaw in modelscope/agentscope from modelscope. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | agentscope | no fix listed | PYSEC-2025-84 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| modelscope | modelscope/agentscope | unspecified – through latest |
Weakness: CWE-497 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N