CVE-2024-8487 is a critical (CVSS 9.8) cross-origin resource sharing flaw in modelscope/agentscope v0.0.4. The server does not limit requests to trusted origins, so any external site can call its API. The record names no fixed release, so restrict who can reach the server and read the project's release notes.
What's affected
The record lists modelscope/agentscope version v0.0.4, a framework for building multi-agent applications. The server's CORS configuration does not restrict access to trusted origins, so any external domain may make requests to the API.
The record says this can lead to unauthorized data access and information disclosure and may allow further exploitation. The score of 9.8 comes from a vector that assumes the attack needs no privileges and no user interaction, which is a generous reading of a CORS problem. In practice the risk depends on what the API exposes and on whether a victim's browser can reach it.
The only reference is a huntr report. We could not read it automatically, so a fixed version is not confirmed here. The project also has a second, separate record in this range for path traversal, CVE-2024-8551, so review both together.
How to check if you're exposed
Check which version of the package your environments have installed.
pip show agentscope
pip list | grep -i agentscope
Run the commands inside each virtual environment, container image and notebook environment that might use it, because the system Python often differs from the project one. For a lockfile or requirements file, search for agentscope and read the pinned version.
Find any running AgentScope server or studio and note which interface and port it listens on. A service bound to all interfaces on a shared network is the case to worry about.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest and flag known vulnerable versions without installing anything.
What to do now
- List installs of agentscope and their versions.
- Find running AgentScope servers and who can reach them.
- Bind the server to localhost or place it behind an authenticating proxy.
- Restrict allowed origins to the exact sites that need access.
- Upgrade to a release the project says fixes the CORS settings, after checking its notes.
- Review the second AgentScope record, CVE-2024-8551, in the same pass.
Why it matters
CORS is a browser rule, not a firewall. When a server replies that every origin is allowed, a script on any web page can talk to it through the visitor's browser, including to addresses on an internal network.
The class is a weak origin check. The fix is a short list of allowed origins, plus real authentication on the API so that a request from the browser does not succeed just because it came from a machine on the right network. Developer tools for AI agents often start with permissive defaults for convenience, and those defaults need tightening before a shared deployment.
The weakness class is CWE-346: Origin Validation Error. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Is a login enough to protect the API?
Authentication on each request helps a lot. Restricting origins is still the right fix for the CORS setting itself.
Is there a related record?
Yes. CVE-2024-8551 covers path traversal in the same project.
Sources
Last reviewed: 19 October 2026.
