CVE-2024-8556: Modelscope Agentscope XSS Vulnerability

CVE-2024-8556 Overview

CVE-2024-8556 is a stored cross-site scripting (XSS) vulnerability in modelscope/agentscope, present as of commit 21161fe on the main branch. The flaw resides in the view that renders detailed run information. A user-controllable run ID string is appended and rendered as HTML without proper output encoding. An attacker can inject arbitrary JavaScript that executes in the context of any user viewing the affected run detail page. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session token theft, UI manipulation, and pivoting to other application actions performed on behalf of the user.

Affected Products

modelscope/agentscope at commit 21161fe on the main branch
Prior builds sharing the vulnerable run inspection view
Deployments exposing the AgentScope web interface to untrusted users

Discovery Timeline

2025-03-20 - CVE-2024-8556 published to NVD
2026-06-17 - Last updated in NVD database
Reported via the Huntr Bounty Report

Technical Details for CVE-2024-8556

Vulnerability Analysis

The vulnerability is a stored XSS in the AgentScope web UI. The run inspection view accepts a run ID controlled by a user and concatenates it directly into rendered HTML output. Because the value is neither HTML-encoded nor validated against a strict character set, an attacker can supply a run ID containing a <script> tag or an event-handler payload. When another user opens the affected run detail page, the browser parses the injected markup and executes the attacker's JavaScript in the origin of the AgentScope application.

The attack requires user interaction, as the target must load the page containing the malicious run ID. However, no authentication is needed to introduce the tainted value in vulnerable deployments, and the payload persists across sessions until the underlying record is removed.

Root Cause

The root cause is missing output encoding when rendering the run ID field into HTML. The application treats the run ID as trusted markup rather than untrusted text. Standard template auto-escaping is either bypassed or not applied at this rendering path, allowing raw HTML and JavaScript to reach the DOM.

Attack Vector

Exploitation occurs over the network with low attack complexity. An attacker submits or creates a run whose ID contains an XSS payload. When a legitimate user later inspects run details, the payload executes with the privileges of that user's browser session. Consequences include stolen authentication material, forced actions in the AgentScope UI, and delivery of secondary payloads. See the Huntr Bounty Report for reproduction details.

Detection Methods for CVE-2024-8556

Indicators of Compromise

Run ID values containing HTML control characters such as <, >, ", ', or the substring script.
Outbound browser requests from AgentScope users to unfamiliar domains immediately after loading a run detail page.
Unexpected DOM modifications or injected <script> and <iframe> elements observed in the AgentScope run inspection view.

Detection Strategies

Review persisted run records for values that do not match the expected run ID format (typically alphanumeric with limited separators).
Inspect web server access logs for requests to run detail endpoints where request or response bodies contain encoded script fragments.
Enable a Content Security Policy (CSP) report-only mode to surface inline script executions originating from the AgentScope origin.

Monitoring Recommendations

Alert on HTTP responses from the AgentScope UI whose bodies contain <script> tags inside run metadata fields.
Monitor authentication events for AgentScope users to detect session reuse from anomalous IP addresses after page loads.
Track browser console errors and CSP violation reports across users of the application.

How to Mitigate CVE-2024-8556

Immediate Actions Required

Update modelscope/agentscope to a build that post-dates commit 21161fe and includes the run ID encoding fix.
Restrict access to the AgentScope web interface to trusted networks until patching is complete.
Purge or sanitize any stored run records whose IDs contain HTML metacharacters.

Patch Information

No vendor advisory URL is currently linked in the NVD entry. Consult the upstream modelscope/agentscope repository for commits addressing the run ID rendering path after 21161fe, and reference the Huntr Bounty Report for validation details.

Workarounds

Deploy a reverse proxy rule that rejects requests whose run ID parameter contains HTML metacharacters.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on the AgentScope UI.
Require authentication and role-based access control on all endpoints that create or view runs to limit attacker reach.

bash

# Example nginx rule blocking HTML metacharacters in the run ID path segment
location ~* /runs/([^/]+) {
    if ($1 ~* "[<>\"'()]|script") { return 400; }
    proxy_pass http://agentscope_backend;
}

# Example CSP header restricting script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";