GHSA-j9rw-qm5f-r8xm

Suggest an improvement
Source
https://github.com/advisories/GHSA-j9rw-qm5f-r8xm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-j9rw-qm5f-r8xm/GHSA-j9rw-qm5f-r8xm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j9rw-qm5f-r8xm
Aliases
Published
2025-03-20T12:32:48Z
Modified
2026-06-29T12:26:17Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
AgentScope path traversal vulnerability in save-workflow
Details

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

Database specific 
{
    "cwe_ids":  [
        "CWE-22",
        "CWE-23"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-20T20:52:49Z",
    "nvd_published_at":  "2025-03-20T10:15:43Z",
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / agentscope

Package

Name
agentscope
View open source insights on deps.dev
Purl
pkg:pypi/agentscope

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.1.1

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5a1
0.0.5
0.0.6a1
0.0.6a2
0.1.0
0.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-j9rw-qm5f-r8xm/GHSA-j9rw-qm5f-r8xm.json"