Executive brief
AgentScope is a framework used to build multi-agent applications powered by large language models. A security flaw in its server configuration allows unauthorized websites to interact with the AgentScope API. This could enable an attacker to steal sensitive data or interact with the system on behalf of a legitimate user if they visit a malicious website.
Technical details
A Cross-Origin Resource Sharing (CORS) vulnerability (CWE-346) exists in modelscope/agentscope version 0.0.4 and earlier. The server's CORS policy is overly permissive, failing to restrict access to trusted origins and allowing any external domain to perform API requests. An attacker can exploit this by hosting a malicious webpage that, when visited by a user with access to the AgentScope server, executes cross-origin requests to extract sensitive information or perform unauthorized actions. This vulnerability requires user interaction (visiting a malicious site) but results in a high impact on confidentiality. No patch is currently specified in the advisory.
Affected products
- ModelScope AgentScope <= 0.0.4
Timeline
- 2025-03-20: advisory: GitHub Advisory published
- 2025-03-20: disclosed: NVD publication date