{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.0.4"}],"component":"agentscope","cve_ids":["CVE-2024-8524"],"ecosystem":"PyPI","epss":0.01186,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-6v28-q95m-93qr","id":"tcs_01M5KGPX3HB06P78EPTN9CJP1C","modified_at":"2026-06-10T17:00:08.928792773Z","published_at":"2025-03-20T10:15:42.853Z","references":["https://osv.dev/vulnerability/PYSEC-2025-83","https://huntr.com/bounties/cc4acf33-700d-4220-8a8a-db28f5c4cc8f","https://github.com/advisories/GHSA-6v28-q95m-93qr"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-83","url":"https://osv.dev/vulnerability/PYSEC-2025-83"}],"summary":"A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read"}