VulnerabilityAnalyzed

CVE-2024-48050

Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.

CRITICAL 9.8EPSS 0.81%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.81% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: modelscope/agentscope
Source: cve@mitre.org

References

https://gist.github.com/AfterSnows/0ad9d233a9d2a5b7e6e5273e2e23508dExploit, Third Party Advisory
https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Code-Execution-via-The-use-of-eval-in-is_callable_expression-and-sanitize_nod-cd4ea6c576da4e0b965ef596855c298dExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.