affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: agentscope
    purl: pkg:pypi/agentscope
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 0.0.4
    type: ECOSYSTEM
  versions:
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
aliases:
- CVE-2024-8501
- GHSA-p6h7-hfj2-vmcf
details: An arbitrary file download vulnerability exists in the rpc_agent_client component
  of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download
  any file from the rpc_agent's host by exploiting the download_file method. This
  can lead to unauthorized access to sensitive information, including configuration
  files, credentials, and potentially system files, which may facilitate further exploitation
  such as privilege escalation or lateral movement within the network.
id: PYSEC-2025-82
modified: '2026-05-21T14:54:21.200335Z'
published: '2025-03-20T10:15:42.610Z'
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/83e433c0-ed2d-4b10-8358-d3c1eee0a47c
- type: ADVISORY
  url: https://github.com/advisories/GHSA-p6h7-hfj2-vmcf
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3