CVE-2025-51427: Code Injection
An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (deymini.yaml) under the key ['nnet']['module'].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModelScopeto a version that resolves this vulnerability.Fixed in 1.25.0 - Configuration
In dey_mini.yaml, ensure the value under key ['nnet']['module'] is not attacker-controlled and refers only to a trusted/expected module.
ModelScope ['nnet']['module'] in dey_mini.yaml = Use only trusted modules; do not load attacker-controlled/crafted module values
Event History
Frequently Asked Questions
What is the risk level of CVE-2025-51427?
CVE-2025-51427 has a risk level of 75, indicating a high threat to security.
What is the severity rating of CVE-2025-51427?
CVE-2025-51427 has a severity rating of 8.1 according to the CVSS v3.1 framework.
How does CVE-2025-51427 allow code execution?
CVE-2025-51427 allows attackers to execute arbitrary code by injecting malicious module configurations in the 'dey_mini.yaml' file.
What version of ModelScope is affected by CVE-2025-51427?
ModelScope version 1.25.0 is vulnerable to CVE-2025-51427.
How can I mitigate the risk of CVE-2025-51427?
To mitigate CVE-2025-51427, ensure that only trusted modules are listed in the configuration file and update to a patched version of ModelScope.