CVE-2024-8524

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 0.0.4

Description A directory traversal issue exists, allowing an attacker to read any local JSON file by sending a crafted POST request to the "/read-examples" endpoint. This enables the attacker to access sensitive information.

Recommendations For modelscope/agentscope version 0.0.4, as a temporary workaround, consider restricting access to the "/read-examples" endpoint until a patch is available. Avoid using this endpoint with untrusted input to minimize the risk of exploitation.