CVE-2024-8556: Stored XSS in modelscope/agentscope
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8556?
CVE-2024-8556 is classified as a stored cross-site scripting (XSS) vulnerability with potential high severity due to the ability to execute arbitrary scripts in a user's browser.
How do I fix CVE-2024-8556?
To fix CVE-2024-8556, ensure that all user-controllable strings, such as run IDs, are properly sanitized and encoded before rendering in the view.
What software is affected by CVE-2024-8556?
CVE-2024-8556 affects ModelScope Agentscope as identified in the latest commit 21161fe.
Can CVE-2024-8556 be exploited remotely?
Yes, CVE-2024-8556 can be exploited remotely since it involves user input that can be manipulated to inject malicious scripts.
What is the impact of CVE-2024-8556?
The impact of CVE-2024-8556 includes potential compromise of user data, session hijacking, and manipulation of web content for malicious purposes.