{"id":"CVE-2024-8502","kind":"vulnerability","aliases":["CVE-2024-8502","GHSA-9w5h-67gf-xvv8"],"related":[],"title":"AgentScope Deserialization Vulnerability","description":"A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.","summary":"AgentScope's RPC agent server calls dill.loads on serialized input in create_agent, so untrusted data is deserialized as Python objects. An attacker who can reach that endpoint can execute arbitrary commands on the server.","severity":"critical","cvss":9.8,"epss":0.01844,"exploited":false,"exploited_at":null,"products":[{"name":"agentscope","fixed":[],"affected":"<= 0.0.6a3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["agentscope","ai-agents","ai-tooling","cwe-502","python","self-hosted"],"not_affected_if":["newer-version","no-rpc-server"],"how_to_check":"- Run `pip show agentscope` and check whether the version is `0.0.6a3` or older.\n- Check whether the RpcAgentServerLauncher / agent server is running in your deployment (unknown whether it is exposed by default).","fix":"- Upgrade the `agentscope` package to a version newer than `0.0.6a3` (the fixed version is unknown from the sources; check GHSA-9w5h-67gf-xvv8).\n- Until upgraded, do not expose the agent server to untrusted networks.","status":"open","published_at":"2025-03-20T10:15:42+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","triaged_at":"2026-10-26T21:08:25+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T21:08:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `agentscope` package to a version newer than `0.0.6a3` (the fixed version is unknown from the sources; check GHSA-9w5h-67gf-xvv8).\n- Until upgraded, do not expose the agent server to untrusted networks.","reach":"network","title":"AgentScope: unsafe dill deserialization lets a request run code","impact":"high","summary":"AgentScope's RPC agent server calls dill.loads on serialized input in create_agent, so untrusted data is deserialized as Python objects. An attacker who can reach that endpoint can execute arbitrary commands on the server.","category":"ai-tooling","nicknames":[],"who_cares":["python","agentscope","ai-agents","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the agent server.","analyst_note":"Confirm the fixed version and whether the RPC server is reachable without auth, via https://github.com/advisories/GHSA-9w5h-67gf-xvv8.","how_to_check":"- Run `pip show agentscope` and check whether the version is `0.0.6a3` or older.\n- Check whether the RpcAgentServerLauncher / agent server is running in your deployment (unknown whether it is exposed by default).","needs_analyst":true,"not_affected_if":["no-rpc-server","newer-version"],"who_is_affected":"Teams running the AgentScope RPC agent server (RpcAgentServerLauncher) built from v0.0.6a3 or earlier, where clients send serialized data to create_agent. Projects that only use AgentScope in-process, without the RPC server, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000651,"input_tokens":3384,"output_tokens":626,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':5A,13A '-502':24B '-8502':6A,14A '67gf':10A '9w5h':9A 'agent':19B,32B,41B,94C 'agentscop':1A,16B,29B 'agentscope':15A 'agentserverservicer.create':93C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'allow':73C 'arbitrari':59B,108C 'attack':51B,105C 'call':34B 'class':69C 'code':76C 'command':60B,109C 'creat':40B 'cve':4A,12A 'cwe':23B 'data':44B,83C 'deseri':2A,46B,80C,100C 'dill':86C 'dill.loads':35B,102C 'enabl':103C 'endpoint':56B 'execut':58B,77C,107C 'ghsa':8A 'ghsa-9w5h-67gf-xvv8':7A 'host':28B 'input':38B,98C 'issu':89C 'librari':87C 'method':95C 'modelscope/agentscope':71C 'object':49B 'occur':90C 'python':25B,48B 'rce':78C 'reach':54B 'remot':75C 'rpc':31B 'rpcagentserverlaunch':68C 'self':27B 'self-host':26B 'serial':37B,97C 'server':33B,63B,112C 'tool':22B 'untrust':43B,82C 'use':84C,101C 'v0.0.6a3':72C 'via':79C 'vulner':3A,65C 'xvv8':11A","nicknames":[],"mitigations":[],"who_affected":"Teams running the AgentScope RPC agent server (RpcAgentServerLauncher) built from v0.0.6a3 or earlier, where clients send serialized data to create_agent. Projects that only use AgentScope in-process, without the RPC server, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:42+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9w5h-67gf-xvv8","url":"https://github.com/advisories/GHSA-9w5h-67gf-xvv8","severity":"critical","published_at":"2025-03-20T12:32:48+00:00","modified_at":"2026-10-26T20:55:27+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","fetched_at":"2026-10-26T20:56:17+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-8502","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8502","severity":null,"published_at":"2025-03-20T10:15:42+00:00","modified_at":"2026-06-17T08:22:45+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}