AgentScope uses `eval`
Date: 2024-11
Affected: pip/agentscope
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-48050
CWE: CWE-94
CWE-95
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

In agentscope <=v0.0.4, the file `agentscope\web\workstation\workflow_utils.py` has the function `is_callable_expression`. Within this function, the line `result = eval(s)` poses a security risk as it can directly execute user-provided commands.


Mitigations:

Architectural layers (MAESTRO):