What is GHSA-6v28-q95m-93qr?

GHSA-6v28-q95m-93qr is a security advisory published by GitHub Security Advisories with High severity. AgentScope directory traversal vulnerability in /read-examples

Which CVE IDs does GHSA-6v28-q95m-93qr cover?

GHSA-6v28-q95m-93qr covers the following CVE IDs: CVE-2024-8524. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6v28-q95m-93qr?

GHSA-6v28-q95m-93qr has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-6v28-q95m-93qr?

GHSA-6v28-q95m-93qr affects 1 product, including: pip/agentscope:\u003c= 0.0.4.

GHSA-6v28-q95m-93qrHighCVSS 7.5

AgentScope directory traversal vulnerability in /read-examples

Vendor

GitHub Security Advisories

Published

March 20, 2025

Last Modified

June 5, 2026

🔗 CVE IDs covered (1)

CVE-2024-8524 →

📋 Description

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.

🎯 Affected products1

pip/agentscope:<= 0.0.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-8524
https://huntr.com/bounties/cc4acf33-700d-4220-8a8a-db28f5c4cc8f
https://github.com/modelscope/agentscope/blob/af8e45ded37b3834c981473b309239e0102473d0/src/agentscope/studio/_app.py#L642
https://github.com/pypa/advisory-database/tree/main/vulns/agentscope/PYSEC-2025-83.yaml
https://github.com/advisories/GHSA-6v28-q95m-93qr