CVE-2026-6604mediumCWE-918

CVE-2026-6604: falha de média gravidade em modelscope agentscope

modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery

Publicada em

Seguir esta CVE+ Monitorar agentscope+ Monitorar agentscope

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 6.9epss 0.3%
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
modelscope · agentscope
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — modelscope agentscope

No mesmo produto, das mais perigosas para as menos.

CVE-2026-6605MEDIUMmodelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgeryEPSS 0.3%CVE-2026-6603MEDIUMmodelscope agentscope _python.py execute_shell_command code injectionEPSS 0.3%CVE-2026-6606MEDIUMmodelscope agentscope _agent_base.py _process_audio_block server-side request forgeryEPSS 0.3%