Modelscope vulnerabilities

Products

• Agentscope 14
• Modelscope/agentscope 10
• Ms-swift 2

Newest

• modelscope ms-swift ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs CVE-2026-85686 8.7 HighSeptember 4, 2026
• agentscope-ai agentscope AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill CVE-2026-85685 8.7 HighSeptember 4, 2026
• modelscope ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading CVE-2026-84202 Fix available 8.7 HighSeptember 1, 2026
• modelscope ms-swift modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash CVE-2026-10801 2.0 LowJune 4, 2026
• modelscope agentscope modelscope agentscope _agent_base.py _process_audio_block server-side request forgery CVE-2026-6606 6.9 MediumApril 20, 2026
• modelscope agentscope modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery CVE-2026-6605 6.9 MediumApril 20, 2026
• modelscope agentscope modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery CVE-2026-6604 6.9 MediumApril 20, 2026
• modelscope agentscope modelscope agentscope _python.py execute_shell_command code injection CVE-2026-6603 6.9 MediumApril 20, 2026
• modelscope ms-agent Command injection vulnerability in ModelScope's ms-agent CVE-2026-2256 Public exploit 6.5 MediumMarch 2, 2026
• modelscope agentscope, modelscope/agentscope +1 more CORS Vulnerability in modelscope/agentscope CVE-2024-8487 7.4 HighMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Stored XSS in modelscope/agentscope CVE-2024-8556 6.1 MediumMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Directory Traversal in modelscope/agentscope CVE-2024-8524 7.5 HighMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Path Traversal in modelscope/agentscope CVE-2024-8537 9.1 CriticalMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Path Traversal in modelscope/agentscope CVE-2024-8551 9.1 CriticalMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Path Traversal in modelscope/agentscope CVE-2024-8438 7.5 HighMarch 20, 2025
• modelscope modelscope/agentscope Remote Code Execution via Deserialization in modelscope/agentscope CVE-2024-8502 9.8 CriticalMarch 20, 2025
• modelscope modelscope/agentscope CSRF due to overly permissive CORS headers in modelscope/agentscope CVE-2024-8489 8.8 HighMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Arbitrary File Download in modelscope/agentscope CVE-2024-8501 7.5 HighMarch 20, 2025
• modelscope agentscope, modelscope/agentscope +1 more Local File Inclusion (LFI) in modelscope/agentscope CVE-2024-8550 7.5 HighFebruary 10, 2025
• modelscope agentscope AgentScope uses `eval` CVE-2024-48050 Fix available 9.8 CriticalNovember 4, 2024