{"data":{"id":"aa0481c0-638d-423b-8a7f-a09a51be56ff","title":"CVE-2024-8502: A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution…","summary":"CVE-2024-8502 affects the RpcAgentServerLauncher class in modelscope/agentscope v0.0.6a3. In the AgentServerServicer.create_agent method, serialized input is deserialized with dill.loads, so untrusted data can be processed. This allows an attacker to execute arbitrary commands on the server. The weakness is classified as CWE-502, and NVD has not yet provided an assessment.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-8502","publishedAt":"2025-03-20T10:15:42.733Z","cveId":"CVE-2024-8502","cweIds":["CWE-502"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["agentscope@<= 0.0.6a3"],"affectedPackageNames":["agentscope"],"affectedPackageRefs":["pypi:agentscope"],"affectedVendors":[],"affectedVendorsRaw":["AgentScope","ModelScope"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"modelscope agentscope RCE via dill deserialization in create_agent","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01844,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-9w5h-67gf-xvv8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:25.083Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}