CVE-2024-8502Critical· 9.8▾ MidnightAgentScope Deserialization Vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.8%
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
agentscope <= 0.0.6a3Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-8537Critical· 9.1AgentScope path traversal vulnerability
CVE-2024-8551Critical· 9.1AgentScope path traversal vulnerability in save-workflow
CVE-2024-8556Medium· 6.1AgentScope stored cross-site scripting (XSS) vulnerability
CVE-2026-6606High· 7.3AgentScope vulnerable to Server-Side Request Forgery
CVE-2026-6603High· 7.3AgentScope Vulnerable to Remote Code Injection
CVE-2026-6605High· 7.3AgentScope vulnerable to Server-Side Request Forgery