CVE-2024-8551 is a critical (CVSS 9.1) path traversal in the save-workflow and load-workflow functions of modelscope/agentscope. An attacker can read and write arbitrary JSON files on the filesystem, which may expose or alter configuration and keys. The record says versions prior to the fix are affected, so confirm the first fixed release.
What's affected
The record names modelscope/agentscope and says versions prior to the fix are affected, without giving a number. The vulnerable features are the save-workflow and load-workflow functions, which are part of the workflow editor.
The weakness lets a caller supply a path that leaves the intended folder. The record says the result is the ability to read and write arbitrary JSON files, with exposure of sensitive information such as configuration files, API keys and hardcoded passwords. JSON is a narrow limit, but configuration, credentials and model settings are very often stored as JSON.
The only reference is a huntr report that we could not read automatically. Check the AgentScope release notes for the first release that names this fix.
How to check if you're exposed
Check which version of the package your environments have installed.
pip show agentscope
pip list | grep -i agentscope
Run the commands inside each virtual environment, container image and notebook environment that might use it, because the system Python often differs from the project one. For a lockfile or requirements file, search for agentscope and read the pinned version.
Find any deployment that exposes the workflow editor or its save and load features, and note who can reach it. Search your configuration folders for JSON files that hold secrets, since those are the files at risk.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can read a dependency manifest and flag known vulnerable versions without installing anything.
What to do now
- Find agentscope installs and versions, and any running workflow editor.
- Upgrade to a release that the project says fixes path handling in workflows.
- Do not expose the editor to untrusted users or networks.
- Move secrets out of JSON files into a secret manager or environment variables.
- Rotate keys that were stored in files the service account can read.
- Run the service as a user with access to a narrow data folder only.
Why it matters
Path traversal bugs come from joining a user supplied name to a base folder without checking the result. A name with parent directory parts walks out of the base folder, and the program then reads or writes wherever it lands.
The class is relative path traversal. A good fix resolves the final path, checks that it is inside the allowed folder, and rejects everything else, or maps names to ids. This record also shows why secrets stored in plain files raise the stakes of any file read bug.
The weakness class is CWE-23: Relative Path Traversal. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which scores 9.1. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Why does JSON only still matter?
Many tools keep keys, tokens and settings in JSON files, so reading or changing them can be serious.
Is the fixed version known?
Not from the sources checked here. Read the project release notes.
Sources
Last reviewed: 19 October 2026.
