VulnSocial

CVE-2026-6604Disclosure

LOWCVSS 5.5 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file src/agentscope/tool/_multi_modality/_openai_tools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument image_url/audio_file_url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-04-20: 3Technical Details · 2026-04-20: 304-20
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-6604 A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/prepare_image/openai_audio_to_text of the file s… https://www.cve.org/CVERecord?id=CVE-2026-6604

    Post summary

    A CVE (CVE‑2026‑6604) has been identified for modelscope agentscope up to 1.0.18, with technical details about the affected function provided, but no PoC, exploitation, patch, or active usage information is included.

    00000100
    57.2K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-6604 Server-Side Request Forgery in ModelScope AgentScope Up to 1.0.18 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6604

    Post summary

    The text announces an SSRF vulnerability (CVE‑2026‑6604) affecting ModelScope AgentScope up to version 1.0.18, but it lacks detailed exploitation information or mitigation guidance.

    0000042
    4.0K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-6604 A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url… CVSS 7.3 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6604 #OpenAI #CyberSecurity #InfoSec

    Post summary

    CVE-2026-6604 is a high‑severity vulnerability in modelscope agentscope up to 1.0.18, affecting the _parse_url function with a CVSS score of 7.3.

    000005
    124 followersView on X

Explore more

Back to dashboard