CVE-2024-8502: AgentScope Deserialization Vulnerability

March 20, 2025 (updated October 26, 2026)

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.

References

github.com/advisories/GHSA-9w5h-67gf-xvv8
github.com/pypa/advisory-database/tree/main/vulns/agentscope/PYSEC-2026-253.yaml
huntr.com/bounties/7a42da2a-2ae5-442d-aff9-c9a3b47870eb
nvd.nist.gov/vuln/detail/CVE-2024-8502
pypi.org/project/agentscope

Code Behaviors & Features

Detect and mitigate CVE-2024-8502 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →