HIGH7.5
PYSEC-2025-83
Details
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/agentscope
Introduced in:
0No fixed version published yet for agentscope (pip). Pin to a known-safe version or switch to an alternative.