CVE-2024-8502: 
Python vulnerability analysis and mitigation

A critical vulnerability has been identified in modelscope/agentscope version 0.0.6a3, specifically in the RpcAgentServerLauncher class. The vulnerability was assigned CVE-2024-8502 and was disclosed on March 20, 2025. This security flaw affects the AgentServerServicer.create_agent method and enables remote code execution (RCE) through deserialization of untrusted data (NVD).

The vulnerability stems from the unsafe deserialization of untrusted data using the dill library within the AgentServerServicer.create_agent method. The issue has been assigned a CVSS v3.0 base score of 9.8 (CRITICAL) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a highly severe vulnerability with network accessibility, low attack complexity, and no required privileges or user interaction. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) (NVD).

The vulnerability allows attackers to execute arbitrary commands on the server through the deserialization of untrusted data. Given the CVSS metrics, successful exploitation could result in complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability is highly exploitable due to its network accessibility, low attack complexity, and no requirement for privileges or user interaction. The attack vector involves sending maliciously crafted serialized data to the affected component (NVD).