CVE-2024-48050: Modelscope Agentscope

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.

Affected products

• Modelscope Agentscope: up to and including 0.0.4

Published 2024-11-04. Last modified 2026-06-17.