| Package | Affected versions | Patched versions |
|---|---|---|
| agentscope | ≤ 0.1.0< 0.0.5a1 | 0.0.5a1 |
| agentscope | ≤ 0.0.4 |
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free