CVE-2024-48050

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48050
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/AfterSnows/0ad9d233a9d2a5b7e6e5273e2e23508d Third Party Advisory Exploit
https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Code-Execution-via-The-use-of-eval-in-is_callable_expression-and-sanitize_nod-cd4ea6c576da4e0b965ef596855c298d Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:modelscope:agentscope:*:*:*:*:*:*:*:*
History

04 Sep 2025, 16:26

Type Values Removed Values Added
First Time Modelscope agentscope
Modelscope
References () https://gist.github.com/AfterSnows/0ad9d233a9d2a5b7e6e5273e2e23508d - () https://gist.github.com/AfterSnows/0ad9d233a9d2a5b7e6e5273e2e23508d - Third Party Advisory, Exploit
References () https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Code-Execution-via-The-use-of-eval-in-is_callable_expression-and-sanitize_nod-cd4ea6c576da4e0b965ef596855c298d - () https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Code-Execution-via-The-use-of-eval-in-is_callable_expression-and-sanitize_nod-cd4ea6c576da4e0b965ef596855c298d - Exploit, Third Party Advisory
CPE cpe:2.3:a:modelscope:agentscope:*:*:*:*:*:*:*:*
Information

Published : 2024-11-04 23:15

Updated : 2025-09-04 16:26

NVD link : CVE-2024-48050

Mitre link : CVE-2024-48050

CVE.ORG link : CVE-2024-48050

JSON object : View

Products Affected

modelscope

  • agentscope
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')