CVE-2024-8556: Stored XSS in modelscope/agentscope

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

Affected products

modelscope/agentscope: through 2024-08-09

References

https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b
https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b

Get alerted when CVE-2024-8556 or the next vulnerability affects your stack