Attack Chain

1. Attacker identifies a vulnerable modelscope agentscope instance running version 1.0.18 or earlier.
2. The attacker crafts a malicious request targeting the _parse_url, prepare_image, or openai_audio_to_text functions within src/agentscope/tool/_multi_modality/_openai_tools.py.
3. The malicious request includes a manipulated image_url or audio_file_url parameter pointing to an internal or external resource controlled by the attacker.
4. The agentscope application processes the request and attempts to retrieve the resource specified in the manipulated URL.
5. Due to the SSRF vulnerability, the server makes an HTTP request to the attacker-controlled resource, potentially bypassing firewalls or other security controls.
6. The attacker's server receives the request from the vulnerable agentscope instance.
7. The attacker can then use the agentscope instance as a proxy to access internal resources or perform other malicious actions.

Impact

Successful exploitation of this SSRF vulnerability (CVE-2026-6604) could allow an attacker to access sensitive information on the internal network, perform unauthorized actions on behalf of the server, or potentially escalate privileges. Depending on the configuration and network topology, the attacker could potentially gain access to other systems and data within the organization's infrastructure. This can lead to data breaches, service disruptions, and other security incidents.

Recommendation

• Upgrade modelscope agentscope to a patched version beyond 1.0.18 to remediate CVE-2026-6604.
• Implement input validation and sanitization on the image_url and audio_file_url parameters to prevent manipulation (reference the vulnerability description).
• Monitor web server logs for suspicious requests targeting the _parse_url, prepare_image, and openai_audio_to_text functions in src/agentscope/tool/_multi_modality/_openai_tools.py (reference the attack chain).
• Deploy the Sigma rules provided to detect potential exploitation attempts in your environment.