Live › vulnerability › CVE-2024-8502
Go to dashboardAgentScope's RPC agent server calls dill.loads on serialized input in create_agent, so untrusted data is deserialized as Python objects. An attacker who can reach that endpoint can execute arbitrary commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:56 UTC, 0h before NVD. All times on this page are UTC.
Teams running the AgentScope RPC agent server (RpcAgentServerLauncher) built from v0.0.6a3 or earlier, where clients send serialized data to create_agent. Projects that only use AgentScope in-process, without the RPC server, are less exposed; the sources do not say more.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| agentscope | pypi | <= 0.0.6a3 | – |
pip show agentscope and check whether the version is 0.0.6a3 or older.agentscope package to a version newer than 0.0.6a3 (the fixed version is unknown from the sources; check GHSA-9w5h-67gf-xvv8).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
This page as .md · .json · in your agent: get_signal("CVE-2024-8502")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.