A critical security vulnerability in ModelScope AgentScope allows unauthenticated remote attackers to perform server-side request forgery and local file inclusion via the audio processing function.

The vulnerability resides in the _process_audio_block function within src/agentscope/agent/_agent_base.py, which uses urllib.request.urlopen to fetch audio URLs without input validation. This allows unauthenticated attackers to specify arbitrary URLs, including those using the file:// protocol, leading to SSRF, LFI, and potential memory exhaustion attacks.

Successful exploitation allows an attacker to interact with internal network resources that are otherwise inaccessible from the public internet. Furthermore, the ability to perform Local File Inclusion exposes sensitive system files to the application process, while the lack of size limits on data reads enables a reliable Denial of Service (DoS) attack, which can crash the application and disrupt critical business services. Given the CVSS score of 7.3, this represents a significant risk to system availability and data confidentiality.

Immediate Action: Update ModelScope AgentScope to the latest patched version immediately to ensure input validation is enforced on all URL parameters.

Proactive Monitoring: Monitor application logs for unusual outbound network requests or attempts to access local file paths (e.g., file://) in audio processing parameters.

Compensating Controls: Implement strict egress filtering at the network level to prevent the application server from initiating connections to unauthorized internal or external endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub Gist referenced by the vulnerability research.

The presence of a publicly available proof-of-concept combined with the ease of triggering the flaw makes this a high-priority remediation task. Organizations utilizing AgentScope should apply the vendor-provided security updates immediately. If patching is not feasible in the short term, implement strict network-level egress controls to limit the reach of potential SSRF attempts until the software can be upgraded.