Back to Database
Status published
Critical
CVE-2024-8502
Remote Code Execution via Deserialization in modelscope/agentscope
Vulnerability Description
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8502
Credits & Attribution
No credits recorded in the NVD database.
More from modelscope
View All →CVE-2024-8556
Stored XSS in modelscope/agentscope
Medium
6.1
CVE-2024-8551
Path Traversal in modelscope/agentscope
Critical
9.1
CVE-2024-8550
Local File Inclusion (LFI) in modelscope/agentscope
High
7.5
CVE-2024-8537
Path Traversal in modelscope/agentscope
Critical
9.1
CVE-2024-8524
Directory Traversal in modelscope/agentscope
High
7.5
Affected Vendor
modelscope
View all reports →Affected Software
modelscope/agentscope
Vulnerable Versions:
unspecified
Timeline
Official Publish:
March 20th, 2025
Last Modified:
March 20th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H