CVE-2026-84202

ModelScope parses model configuration files using PyYAML's unsafe yaml.Loader, which supports Python object construction tags and therefore performs deserialization of untrusted data (CWE-502). An attacker hosts or compromises a model repository containing a poisoned configuration file; when a victim downloads and loads that model through ModelScope, the crafted YAML triggers construction of arbitrary Python objects and executes attacker-controlled code. Successful exploitation yields arbitrary code execution on the victim's machine or CI runner with the privileges of the loading process. Affected users are developers, ML practitioners, and automated pipelines that pull models and their configuration files from ModelScope Hub. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days.

What to do: Since no fixed version is specified in the available data, monitor the ModelScope project for a patched release and upgrade promptly when one is announced. In the interim, only load models and configuration files from trusted repositories, and audit machines and CI runners where ModelScope loads models for signs of unexpected code execution; where feasible, prefer safe YAML loading (e.g., PyYAML's safe_load/safe_loader without Python object tags) when handling untrusted configs.