CVE-2026-84202 in ModelScope
Summary
by MITRE • 09/01/2026
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability in ModelScope stems from the improper handling of YAML configuration files using PyYAML's unsafe loader mechanism. Specifically, the application utilizes yaml.Loader or an equivalent untrusted loading method that permits Python object construction tags such as !!python/object/new. This design flaw allows for arbitrary code execution because the YAML parser interprets these special tags not merely as data structures but as instructions to instantiate specific Python classes and invoke their methods during the deserialization process. When a user loads a model configuration file containing these malicious payloads, the underlying PyYAML engine executes the embedded Python code automatically without any additional validation or security checks.
This issue represents a classic instance of insecure deserialization where untrusted data is processed by a vulnerable component that allows for side effects beyond simple data parsing. The technical flaw lies in the failure to restrict the set of allowed tags during YAML loading, thereby exposing the application to remote code execution attacks. Attackers can craft malicious model repositories containing poisoned configuration files designed specifically to exploit this behavior. By embedding Python object construction directives within the YAML structure, an adversary can force the victim's environment to execute arbitrary commands, potentially leading full system compromise depending on the privileges under which ModelScope operates.
The operational impact of this vulnerability is severe as it undermines the integrity and security of the model repository ecosystem. Users who download or load models from untrusted sources risk having their local environments compromised without any explicit action beyond loading the configuration file. This can lead to data exfiltration, installation of persistent backdoors, or use of the affected system for further attacks against other network resources. The trust placed in model repositories is exploited since users typically assume that downloaded configurations are benign metadata rather than executable code vectors.
To mitigate this risk, it is imperative to replace unsafe YAML loading methods with secure alternatives such as yaml.safe_load which restricts parsing to standard data types and prevents the execution of arbitrary Python objects. Additionally, implementing strict input validation and whitelisting allowed tags can provide an additional layer of defense against similar injection attacks. Organizations should also enforce code review practices that identify instances of insecure deserialization patterns in configuration handling logic. Aligning with industry standards such as CWE-502 which addresses Deserialization of Untrusted Data helps ensure that development teams prioritize secure parsing mechanisms to prevent arbitrary code execution vulnerabilities in future updates and deployments.