CVE-2024-8537Critical· 9.1▾ MidnightAgentScope path traversal vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
agentscope <= 0.1.1Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-8551Critical· 9.1AgentScope path traversal vulnerability in save-workflow
CVE-2024-8502Critical· 9.8AgentScope Deserialization Vulnerability
CVE-2024-8556Medium· 6.1AgentScope stored cross-site scripting (XSS) vulnerability
CVE-2026-6606High· 7.3AgentScope vulnerable to Server-Side Request Forgery
CVE-2026-6603High· 7.3AgentScope Vulnerable to Remote Code Injection
CVE-2026-6605High· 7.3AgentScope vulnerable to Server-Side Request Forgery