~ / search / GHSA-j9rw-qm5f-r8xm

GHSA-j9rw-qm5f-r8xm

AgentScope path traversal vulnerability in save-workflow

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-8551

Packages

EcosystemPackageAffectedFixed in
PyPI agentscope <= 0.1.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

References

External links from the advisory. They lead to third-party sites.