Description
AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
agentscope-ai agentscope
Default version status: unaffected
0 to ≤ 2.0.7.post1affected
pkg:pypi/agentscopeReferences
- https://github.com/agentscope-ai/agentscope/issues/2069 ↗
- https://github.com/agentscope-ai/agentscope ↗
- https://github.com/agentscope-ai/agentscope/blob/v2.0.7.post1/src/agentscope/workspace/_local_workspace.py ↗
- https://www.vulncheck.com/advisories/agentscope-through-2.0.7-post1-arbitrary-directory-copy-via-add-skill ↗