HIGH 8.7 NVD
CVE-2026-84202
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attac
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
References
- https://github.com/modelscope/modelscope
- https://github.com/modelscope/modelscope/blob/v1.40.0/modelscope/models/audio/tts/voice.py
- https://github.com/modelscope/modelscope/blob/v1.40.0/modelscope/models/multi_modal/mplug/
- https://github.com/modelscope/modelscope/issues/1660
- https://www.vulncheck.com/advisories/modelscope-through-1.40.0-unsafe-yaml-deserialization
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-01 via NVD.
vulnfeed aggregates 11520 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.