CVE-2026-84202
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
Schwachstellenklasse
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
Quellen
- https://github.com/modelscope/modelscope
- https://github.com/modelscope/modelscope/blob/v1.40.0/modelscope/models/audio/tts/voice.py
- https://github.com/modelscope/modelscope/blob/v1.40.0/modelscope/models/multi_modal/mplug/configuration_mplug.py
- https://github.com/modelscope/modelscope/issues/1660
- https://www.vulncheck.com/advisories/modelscope-through-1.40.0-unsafe-yaml-deserialization-in-model-config-loading
- https://github.com/modelscope/modelscope/issues/1660
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.