---
id: "CVE-2024-8551"
kind: "vulnerability"
aliases: ["CVE-2024-8551", "GHSA-j9rw-qm5f-r8xm"]
title: "AgentScope path traversal vulnerability in save-workflow"
severity: "critical"
cvss: 9.1
epss: 0.01022
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "agentscope", "fixed": [], "affected": "<= 0.1.1", "ecosystem": "pypi"}, {"name": "modelscope agentscope", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["agentscope", "ai-agents", "ai-tooling", "cwe-22", "cwe-23", "python"]
not_affected_if: ["fixed-paths-only"]
published_at: "2025-03-20T10:15:43+00:00"
first_seen_at: "2026-10-26T20:56:17+00:00"
updated_at: "2026-10-26T21:20:32+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-j9rw-qm5f-r8xm", "first_seen_at": "2026-10-26T20:56:17+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8551", "first_seen_at": "2026-10-26T21:20:32+00:00"}]
---

# AgentScope path traversal vulnerability in save-workflow

AgentScope's save-workflow and load-workflow functions do not restrict file paths, so a crafted name can point outside the intended folder. An attacker can read and overwrite arbitrary JSON files on the host, including configuration files that may hold API keys or passwords.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:agentscope affected <= 0.1.1 fixed ?
- vendor:modelscope agentscope affected ? fixed ?

## How to check

- Run `pip show agentscope` and check whether the version is `0.1.1` or lower.
- Look for calls to save-workflow or load-workflow that take a file name or path from user input.

## Fix

- Upgrade the `agentscope` package to a version after `0.1.1` (the fixed version is not stated in the source; check the GHSA advisory).
- Until upgraded, do not pass untrusted input as workflow file names.

## Timeline

- 2026-10-26T20:56:17+00:00 ghsa https://github.com/advisories/GHSA-j9rw-qm5f-r8xm
- 2026-10-26T21:20:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-8551

## From the sources

A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_