Live › vulnerability › CVE-2024-8537
Go to dashboardAgentScope, a Python agent framework, has a path traversal flaw in its /delete-workflow endpoint because file paths are not validated. An attacker can delete arbitrary files on the server outside the intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:56 UTC, 0h before NVD. All times on this page are UTC.
Deployments of AgentScope at version 0.1.1 or lower that run its web service and expose the /delete-workflow endpoint are exposed. The sources say the issue affects all versions and do not name a fixed release. Teams that only import the library without running this endpoint are less likely to be exposed, but the sources do not confirm this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| agentscope | pypi | <= 0.1.1 | – |
| modelscope agentscope | vendor | – | – |
pip show agentscope and check whether the version is 0.1.1 or lower/delete-workflow endpointUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
This page as .md · .json · in your agent: get_signal("CVE-2024-8537")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.