Remote Code Execution Vulnerability in ModelScope Agentscope by Vendor
CVE-2024-8502

9.8CRITICAL

Key Information:

Vendor

Modelscope

Status
Modelscope/agentscope
Vendor
CVE Published:
20 March 2025

What is CVE-2024-8502?

A remote code execution vulnerability has been identified in the RpcAgentServerLauncher class of ModelScope's Agentscope, specifically in version v0.0.6a3. This vulnerability is due to insecure deserialization of untrusted data via the dill library within the AgentServerServicer.create_agent method. An attacker can exploit this flaw by providing malicious serialized input, which is then deserialized using dill.loads. This can lead to the execution of arbitrary commands on the server, posing a significant risk to system integrity and user data.

Affected Version(s)

modelscope/agentscope <= unspecified

References

https://huntr.com/bounties/7a42da2a-2ae5-442d-aff9-c9a3b4...

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.