---
id: CVE-2024-8556
aliases:
  - GHSA-6mf6-7j75-2m6f
  - PYSEC-2026-1076
title: AgentScope stored cross-site scripting (XSS) vulnerability
summary: AgentScope stored cross-site scripting (XSS) vulnerability
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: agentscope
product: agentscope
ecosystem: pip
affected:
  - agentscope <= 0.1.1
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6mf6-7j75-2m6f'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8556'
  - url: 'https://github.com/modelscope/agentscope'
  - url: >-
      https://github.com/modelscope/agentscope/blob/21161fe9985ee2a2f617180b00a1424b81302d42/src/agentscope/studio/static/js/dashboard.js#L90
  - url: 'https://huntr.com/bounties/8439f16b-5256-4466-bb7d-371572572a4b'
tags:
  - osv
  - pip
epss: 0.00417
epssPercentile: 0.33314
ingestedAt: '2026-07-08T18:25:46.490Z'
---

## Overview

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.

## Affected packages

- `agentscope <= 0.1.1`

## Remediation

Refer to the advisory for the patched release.