{"id":"CVE-2024-8551","kind":"vulnerability","aliases":["CVE-2024-8551","GHSA-j9rw-qm5f-r8xm"],"related":[],"title":"AgentScope path traversal vulnerability in save-workflow","description":"A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.","summary":"AgentScope's save-workflow and load-workflow functions do not restrict file paths, so a crafted name can point outside the intended folder. An attacker can read and overwrite arbitrary JSON files on the host, including configuration files that may hold API keys or passwords.","severity":"critical","cvss":9.1,"epss":0.01022,"exploited":false,"exploited_at":null,"products":[{"name":"agentscope","fixed":[],"affected":"<= 0.1.1","ecosystem":"pypi"},{"name":"modelscope agentscope","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["agentscope","ai-agents","ai-tooling","cwe-22","cwe-23","python"],"not_affected_if":["fixed-paths-only"],"how_to_check":"- Run `pip show agentscope` and check whether the version is `0.1.1` or lower.\n- Look for calls to save-workflow or load-workflow that take a file name or path from user input.","fix":"- Upgrade the `agentscope` package to a version after `0.1.1` (the fixed version is not stated in the source; check the GHSA advisory).\n- Until upgraded, do not pass untrusted input as workflow file names.","status":"open","published_at":"2025-03-20T10:15:43+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","triaged_at":"2026-10-26T21:08:30+00:00","updated_at":"2026-10-26T21:20:32+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-26T21:08:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `agentscope` package to a version after `0.1.1` (the fixed version is not stated in the source; check the GHSA advisory).\n- Until upgraded, do not pass untrusted input as workflow file names.","reach":"unknown","title":"AgentScope: path traversal in save and load workflow reads and writes files","impact":"high","summary":"AgentScope's save-workflow and load-workflow functions do not restrict file paths, so a crafted name can point outside the intended folder. An attacker can read and overwrite arbitrary JSON files on the host, including configuration files that may hold API keys or passwords.","category":"ai-tooling","nicknames":[],"who_cares":["python","agentscope","ai-agents"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads and overwrites arbitrary JSON files, exposing stored API keys.","analyst_note":"Confirm the fixed version and whether save-workflow or load-workflow are reachable without auth; see https://github.com/advisories/GHSA-j9rw-qm5f-r8xm.","how_to_check":"- Run `pip show agentscope` and check whether the version is `0.1.1` or lower.\n- Look for calls to save-workflow or load-workflow that take a file name or path from user input.","needs_analyst":true,"not_affected_if":["fixed-paths-only"],"who_is_affected":"Teams that run AgentScope 0.1.1 or earlier and expose its save-workflow or load-workflow functions to input they do not fully control. Deployments where only trusted developers call these functions with fixed paths are less exposed. unknown whether the functions are reachable over a network by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000646,"input_tokens":3382,"output_tokens":615,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':10A,18A '-22':31B '-23':33B '-8551':11A,19A 'agent':26B 'agentscop':1A,23B,35B 'agentscope':20A,22A 'ai':25B,28B 'ai-ag':24B 'ai-tool':27B 'allow':106C 'api':78B,133C 'arbitrari':66B,113C 'attack':61B,108C 'configur':73B,131C 'craft':52B 'cve':9A,17A 'cwe':30B,32B 'exist':86C 'exposur':123C 'file':48B,68B,74B,115C,132C 'filesystem':118C 'fix':103C 'folder':59B 'function':44B,96C 'ghsa':13A 'ghsa-j9rw-qm5f-r8xm':12A 'hardcod':136C 'hold':77B 'host':71B 'includ':72B 'inform':128C 'intend':58B 'j9rw':14A 'json':67B,114C 'key':79B,134C 'lead':120C 'load':42B,94C 'load-workflow':41B,93C 'may':76B 'modelscope':21A 'modelscope/agentscope':98C 'modif':125C 'name':53B 'outsid':56B 'overwrit':65B 'password':81B,137C 'path':2A,49B,83C 'point':55B 'potenti':119C 'prior':100C 'python':34B 'qm5f':15A 'r8xm':16A 'read':63B,110C 'restrict':47B 'save':7A,38B,90C 'save-workflow':6A,37B,89C 'sensit':127C 'tool':29B 'travers':3A,84C 'version':99C 'vulner':4A,85C,105C 'workflow':8A,39B,43B,91C,95C 'write':112C","nicknames":[],"mitigations":[],"who_affected":"Teams that run AgentScope 0.1.1 or earlier and expose its save-workflow or load-workflow functions to input they do not fully control. Deployments where only trusted developers call these functions with fixed paths are less exposed. unknown whether the functions are reachable over a network by default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-03-20T10:15:43+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j9rw-qm5f-r8xm","url":"https://github.com/advisories/GHSA-j9rw-qm5f-r8xm","severity":"critical","published_at":"2025-03-20T12:32:48+00:00","modified_at":"2026-10-26T20:55:46+00:00","first_seen_at":"2026-10-26T20:56:17+00:00","fetched_at":"2026-10-26T21:01:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-8551","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8551","severity":null,"published_at":"2025-03-20T10:15:43+00:00","modified_at":"2026-06-17T08:22:50+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}