What is GHSA-6mf6-7j75-2m6f?

GHSA-6mf6-7j75-2m6f is a security advisory published by GitHub Security Advisories with Medium severity. AgentScope stored cross-site scripting (XSS) vulnerability

Which CVE IDs does GHSA-6mf6-7j75-2m6f cover?

GHSA-6mf6-7j75-2m6f covers the following CVE IDs: CVE-2024-8556. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6mf6-7j75-2m6f?

GHSA-6mf6-7j75-2m6f has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6mf6-7j75-2m6f?

GHSA-6mf6-7j75-2m6f affects 1 product, including: pip/agentscope:\u003c= 0.1.1.

GHSA-6mf6-7j75-2m6fMediumCVSS 6.1

AgentScope stored cross-site scripting (XSS) vulnerability

Vendor

GitHub Security Advisories

Published

March 20, 2025

Last Modified

March 20, 2025

🔗 CVE IDs covered (1)

CVE-2024-8556 →

📋 Description

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

🎯 Affected products1

pip/agentscope:<= 0.1.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-8556
https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b
https://github.com/modelscope/agentscope/blob/21161fe9985ee2a2f617180b00a1424b81302d42/src/agentscope/studio/static/js/dashboard.js#L90
https://github.com/advisories/GHSA-6mf6-7j75-2m6f