CVE-2026-84202: ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModelScopeto a version that resolves this vulnerability.Fixed in 1.40.0 - Configuration
Update ModelScope model configuration parsing to avoid PyYAML's unsafe yaml.Loader (which allows Python object construction tags), and instead use a safe loader so malicious tags cannot trigger code execution when config files are loaded.
ModelScope model config loading YAML loader used for model configuration files (PyYAML yaml.Loader) = Do not use PyYAML's unsafe yaml.Loader; use a safe YAML loader instead
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who load model repositories whose configuration files are parsed by ModelScope are exposed, particularly when obtaining models from untrusted or insufficiently vetted sources.
What does an attacker need to exploit it?
An attacker needs to craft a malicious model repository containing a poisoned YAML configuration file that uses Python object construction tags. The victim must load that repository; no attacker authentication or special privileges are required.
Does exploitation require user interaction?
Yes. Exploitation occurs when a user loads a malicious model repository or its configuration, as reflected by the UI:R vector.
What can be done if updating is not immediately possible?
Avoid loading model repositories from untrusted sources, and review YAML model configuration files for Python object construction tags before loading them. Limit use to repositories that have been vetted and trusted.