What’s Vulnerable › Vulnerabilities
CVE-2024-8489: CSRF due to overly permissive CORS headers in modelscope/agentscope
- Severity: high (CVSS 8.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-352
Description
A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, including the `api/file` endpoint, enabling the reading of arbitrary files on the target's local file system through CSRF.
Affected products
- modelscope/agentscope: through latest
References
Get alerted when CVE-2024-8489 or the next vulnerability affects your stack