{"id":"CVE-2024-8556","aliases":["GHSA-6mf6-7j75-2m6f","PYSEC-2026-1076"],"title":"AgentScope stored cross-site scripting (XSS) vulnerability","summary":"AgentScope stored cross-site scripting (XSS) vulnerability","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","vendor":"agentscope","product":"agentscope","ecosystem":"pip","affected":["agentscope <= 0.1.1"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6mf6-7j75-2m6f","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8556"},{"url":"https://github.com/modelscope/agentscope"},{"url":"https://github.com/modelscope/agentscope/blob/21161fe9985ee2a2f617180b00a1424b81302d42/src/agentscope/studio/static/js/dashboard.js#L90"},{"url":"https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b"}],"tags":["osv","pip"],"epss":0.00417,"epssPercentile":0.35651,"ingestedAt":"2026-07-08T18:25:46.490Z","slug":"CVE-2024-8556","body":"## Overview\n\nA stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.\n\n## Affected packages\n\n- `agentscope <= 0.1.1`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}