ModelScope vulnerabilities
We track 16 vulnerabilities in ModelScope products across 4 products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on September 4, 2026.
Latest ModelScope vulnerabilities
- 7.5 High severity
ms-swift: Server-Side Request Forgery
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or v
- 8.8 High severity
modelscope: Deserialization of Untrusted Data
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when
- 7.3 High severity
agentscope: Server-Side Request Forgery
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request for
- 7.3 High severity
agentscope: Server-Side Request Forgery
A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web_url of the file src/agentscope/_utils/_common.py of the component Internal Service. Performing a manipulation results in server-side reques
- 7.3 High severity
agentscope: Server-Side Request Forgery
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint
- 7.3 High severity
agentscope: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function execute_python_code/execute_shell_command of the file src/AgentScope/tool/_coding/_python.py. This manipulation causes code injection. The atta
- 9.1 Critical severity
modelscope/agentscope: Relative Path Traversal
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading t
- 9.1 Critical severity
modelscope/agentscope: Path Traversal: '..filename'
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to
- 7.5 High severity
modelscope/agentscope: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.
- 9.8 Critical severity
modelscope/agentscope: Deserialization of Untrusted Data
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where se
- 8.8 High severity
modelscope/agentscope: Absolute Path Traversal
An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead t
- 8.8 High severity
modelscope/agentscope: Cross-Site Request Forgery
A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerabi
- 9.8 Critical severity
modelscope/agentscope: Origin Validation Error
A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the
- 7.5 High severity
modelscope/agentscope: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.
- 7.5 High severity
modelscope/agentscope: Exposure of Sensitive System Information to an Unauthorized Control Sphere
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating
- 9.8 Critical severity
agentscope: Improper Control of Generation of Code
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.