CVE-2024-48050: Code Injection
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
Other sources
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48050?
CVE-2024-48050 is classified as a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-48050?
To fix CVE-2024-48050, update the agentscope package to version 0.0.5 or later, which addresses the vulnerable use of eval.
What impact does CVE-2024-48050 have on affected systems?
CVE-2024-48050 allows attackers to execute arbitrary code, compromising the security of the affected system.
Which versions of agentscope are affected by CVE-2024-48050?
CVE-2024-48050 affects agentscope versions up to and including 0.0.4.
Is CVE-2024-48050 related to unauthenticated access?
Yes, CVE-2024-48050 allows unauthenticated remote code execution, making it particularly dangerous.