Vulnerability Description
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/modelscope/modelscope
- https://github.com/modelscope/modelscope/blob/v1.40.0/modelscope/models/audio/tt
- https://github.com/modelscope/modelscope/blob/v1.40.0/modelscope/models/multi_mo
- https://github.com/modelscope/modelscope/issues/1660
- https://www.vulncheck.com/advisories/modelscope-through-1.40.0-unsafe-yaml-deser
- https://github.com/modelscope/modelscope/issues/1660
FAQ
What is CVE-2026-84202?
CVE-2026-84202 is a vulnerability with a CVSS score of 8.8 (HIGH). ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositor...
How severe is CVE-2026-84202?
CVE-2026-84202 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84202?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.