PYSEC-2024-262
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/agentscope/PYSEC-2024-262.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2024-262
- Aliases
-
- CVE-2024-48050
- GHSA-6p55-qr3j-mpgq
- Published
- 2024-11-04T23:15:04.250Z
- Modified
- 2026-06-10T17:00:07.207783608Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
- References
Affected packages
PyPI / agentscope
Package
- Name
- agentscope
- View open source insights on deps.dev
- Purl
- pkg:pypi/agentscope