ByteOS Network

NVD Vulnerability Details :

CVE-2024-8556

Analyzed

Source-security@huntr.dev

Published At-20 Mar, 2025 | 10:15

Updated At-01 Apr, 2025 | 20:31

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CPE Matches

modelscope>>agentscope>>Versions up to 2024-08-09(inclusive)

cpe:2.3:a:modelscope:agentscope:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security@huntr.dev

References

Hyperlink	Source	Resource
https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b	security@huntr.dev	Exploit
https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History