Description

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T16:17:34.450Z",
  "pubdate": "2026-09-01T16:17:34.450Z",
  "executiveSummary": "ModelScope is susceptible to an Arbitrary Code Execution (ACE) vulnerability stemming from the insecure deserialization of configuration files.\nThe vulnerability arises from the utilization of the unsafe yaml.Loader within the PyYAML library when parsing model metadata.\nBy crafting a malicious model repository containing a poisoned YAML configuration file, an attacker can leverage Python object construction tags to execute arbitrary system commands upon repository loading.\nThis vulnerability poses a critical risk to users who interact with untrusted or compromised model repositories within the ModelScope ecosystem.\nSuccessful exploitation allows an unauthenticated attacker to gain remote code execution capabilities with the same privileges as the user process running the model loading function.\nThe primary risk implication involves full system compromise, unauthorized data exfiltration, and potential lateral movement within the host environment.\nNo special authentication is required to exploit the vulnerability; the attacker only needs the user to attempt to load a malicious model configuration.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of YAML deserialization in ModelScope, specifically the application of the 'unsafe' loader provided by the PyYAML library.\nIn PyYAML, the 'yaml.Loader' or 'yaml.load()' function, without an explicit Loader parameter specifying 'SafeLoader', permits the instantiation of arbitrary Python objects using the '!!python/object/apply' or similar construction tags.\nWhen ModelScope parses a model configuration file, it processes the YAML content provided by the repository. If an attacker injects malicious YAML tags into this file, the parser interprets these tags during the object construction phase.\nThe attack flow follows a predictable sequence: First, the attacker hosts a malicious model repository containing a configuration file (e.g., configuration.json or similar YAML-formatted metadata) that includes a serialized Python payload. Second, a user triggers a function within ModelScope that parses this configuration file.\nThe parser encounters the malicious tag and executes the referenced Python constructor, such as 'os.system' or 'subprocess.run', effectively turning the configuration file into an executable script.\nBecause the deserialization occurs during the standard initialization process of the model loading routine, the malicious code is executed automatically without requiring additional user interaction or specific function triggers beyond the initial load.\nThe impact of this exploit is catastrophic, as it grants the attacker the ability to execute arbitrary code within the context of the running Python process. This facilitates post-exploitation activities such as environment discovery, file system manipulation, credential theft, and persistent access establishment.\nSince the vulnerability is embedded in the way the application processes external, user-supplied YAML data, any network-exposed component or locally run tool relying on ModelScope to pull and initialize models from external sources is considered vulnerable. There are no privilege requirements for the initial trigger; however, the level of system access obtained by the attacker depends on the privileges of the user account executing the ModelScope library."
}