Skip to content

add a security vulnerability description #877

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wangxingjun778 merged 1 commit into from
Mar 4, 2026
Merged

add a security vulnerability description #877

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions .github/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Security Policy

## Reporting a Vulnerability

If you believe you have found a security vulnerability in **MS-Agent**, please report it responsibly.

- **Preferred**: Use GitHub **Private Vulnerability Reporting** (Security → Advisories → Report a vulnerability), if enabled.
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

It's good practice to provide a dedicated security email address as a fallback for reporting vulnerabilities. This is useful if GitHub's Private Vulnerability Reporting isn't enabled or if a reporter prefers email. The main ModelScope project uses security@modelscope.org. It would be beneficial to add this as an alternative contact method here as well.

Suggested change
- **Preferred**: Use GitHub **Private Vulnerability Reporting** (Security → Advisories → Report a vulnerability), if enabled.
- **Preferred**: Use GitHub **Private Vulnerability Reporting** (Security → Advisories → Report a vulnerability), if enabled.
- **Alternative**: Email us at `security@modelscope.org`.

- **Do not** open a public GitHub Issue for security reports.

Please include:
- A clear description of the issue and impact
- A minimal proof-of-concept (PoC), if possible
- Affected versions/commits
- Reproduction steps and environment details
- Any suggested mitigations/fix ideas (optional)

We will acknowledge receipt as soon as possible and work with you on coordinated disclosure.

## Scope

In scope includes (but is not limited to):
- Tool execution security
- Prompt/document injection leading to unsafe tool usage
- Arbitrary file read/write, path traversal
- SSRF and internal network access through tools
- Unsafe deserialization (pickle/yaml/etc.)

Out of scope:
- Issues in third-party dependencies with no exploitable path through MS-Agent
- Misconfigurations or insecure deployments not recommended by the project
- Social engineering attacks that do not involve a technical vulnerability in MS-Agent

## Disclosure Process

- We will confirm receipt of your report.
- We will investigate and validate the issue.
- We will coordinate a fix and release.
- We may publish a GitHub Security Advisory (and request a CVE when appropriate).
- We will credit reporters where possible (unless you prefer to remain anonymous).
Loading