CVE-2024-8502: AgentScope Deserialization Vulnerability
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
Published Mar 20, 2025
Affected packages
agentscope
- Ecosystem
- PyPI
- Affected
- <= 0.0.6a3
- Fixed in
- No patched version yet
- Check
pip show agentscope
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology