Modelscope Agentscope Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Modelscope Agentscope, as of the latest commit 21161fe on the main branch. This vulnerability arises in the view for detailed run information inspection, where a user-controllable string, the run ID, is appended and rendered as HTML. This flaw enables an attacker to execute arbitrary JavaScript in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user's browser.