ModelScope AgentScope: Path traversal in insert_text_file
Summary
AgentScope, a Python framework for multi-agent applications, contains a path traversal flaw in its insert_text_file tool. An authenticated low-privilege user can supply crafted file paths to read or modify files outside the intended workspace, with high impact on confidentiality and integrity. Exposure is highest where agents are reachable by external users or process untrusted content, since prompt injection can also drive the tool. The affected version range is disputed between sources and must be verified.
Affected
- ModelScope AgentScope 1.0.0 to 1.0.8 (per CVE description and VulDB).
- The gist by the discoverer names 1.0.18, 1.0.19 and 1.0.19.post1 instead. The vendor's version data could not be confirmed; the CNA record lists affected versions as n/a.
- Affected component: insert_text_file in _write_text_file.py.
Fixed in
Unknown.
- A pull request titled 'fix(tool): fix path traversal vulnerability in insert_text_file and write_text_file' exists, but its merge status and the first fixed release could not be confirmed.
- No vendor security advisory was found.
Workaround
- No vendor-confirmed workaround.
- Disable the insert_text_file tool in agents where it is not required.
- Run the agent process as a low-privilege user in a container or sandbox, with write access limited to the directories it needs.
- Do not expose agents with this tool to untrusted users or untrusted document content.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No exploitation in the wild found; one source lists the CVE as not in KEV.
- A public gist is referenced as a proof of concept. Its content could not be verified.
Our recommendation
- Inventory all AgentScope deployments and record their versions; treat 1.0.0 to 1.0.8 and the versions named in the gist as potentially affected.
- Restrict who can reach agents that use file tools, and limit file permissions for the agent process.
- Upgrade to a release that contains the merged fix once the vendor confirms it.
- Re-check NVD and the vendor repository for updates before closing this item.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-51570 Gist (discoverer) gist.github.com
- VulDB CVE-2026-51570 vuldb.com
- CodeAnt CVE-2026-51570 codeant.ai
- AgentScope pull requests github.com
- AgentScope security page github.com
- Strix CVE-2026-51570 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:05.
Original description (NVD)
modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.