PatchTheCVEmodelscope vulnerabilities
Recent CVEs affecting modelscope products. 9 tracked.
modelscope has 9 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-03-20. Highest priority: CVE-2024-48050 (score 59/100).
- CVE-2024-8556 MEDIUM 6.1 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 211
- CVE-2024-8551 CRITICAL 9.1 MITIGATE A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agent
- CVE-2024-8550 HIGH 7.5 DOWNGRADE A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope vers
- CVE-2024-8537 CRITICAL 9.1 MITIGATE A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions
- CVE-2024-8524 HIGH 7.5 DOWNGRADE A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4
- CVE-2024-8501 HIGH 8.8 DOWNGRADE An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope ver
- CVE-2024-8487 CRITICAL 9.8 DOWNGRADE A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4
- CVE-2024-8438 HIGH 7.5 DOWNGRADE A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4
- CVE-2024-48050 CRITICAL 9.8 UPGRADE In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_exp
FAQ
How do I fix modelscope vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is modelscope being exploited right now?
None of the tracked modelscope CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which modelscope CVE should I patch first?
CVE-2024-48050 currently ranks highest (59/100): In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_exp.