CVE-2024-8556: AgentScope stored cross-site scripting (XSS) vulnerability

March 20, 2025

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user’s browser.

References

github.com/advisories/GHSA-6mf6-7j75-2m6f
github.com/modelscope/agentscope
github.com/modelscope/agentscope/blob/21161fe9985ee2a2f617180b00a1424b81302d42/src/agentscope/studio/static/js/dashboard.js
huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b
nvd.nist.gov/vuln/detail/CVE-2024-8556

Code Behaviors & Features

Detect and mitigate CVE-2024-8556 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →