CVE-2026-6606mediumCWE-918

CVE-2026-6606: falha de média gravidade em modelscope agentscope

modelscope agentscope _agent_base.py _process_audio_block server-side request forgery

Publicada em

Seguir esta CVE+ Monitorar agentscope+ Monitorar agentscope

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 6.9epss 0.3%
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_audio_block of the file src/agentscope/agent/_agent_base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
modelscope · agentscope
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — modelscope agentscope

No mesmo produto, das mais perigosas para as menos.

CVE-2026-6605MEDIUMmodelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgeryEPSS 0.3%CVE-2026-6603MEDIUMmodelscope agentscope _python.py execute_shell_command code injectionEPSS 0.3%CVE-2026-6604MEDIUMmodelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgeryEPSS 0.3%