CVE-2024-8556: Modelscope Agentscope

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

Affected products

• Modelscope Agentscope: up to and including 2024-08-09

Published 2025-03-20. Last modified 2026-06-17.