Command injection vulnerability in ModelScope's ms-agent
Priority HIGH 68CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.
Summary
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02055 81st percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| modelscope | ms-agent | up to v1.6.0rc1 | — | No fix listed | CNA |
| — | ms-agent (PyPI) | up to 1.6.0rc1 | — | No fix listed | GHSA-4gc2-344q-r2rw |
- ms-agent Vendormodelscope Affected up to v1.6.0rc1 Fixed in — No fix listed CNA
- ms-agent (PyPI) Vendor— Affected up to 1.6.0rc1 Fixed in — No fix listed GHSA-4gc2-344q-r2rw
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2256
- 2026-10-03 Alias added: GHSA-4gc2-344q-r2rw
References
Other 5
- https://github.com/modelscope/ms-agent
- https://www.hiddenlayer.com/research/indirect-prompt-injection-of-claude-computer-use
- https://medium.com/@itamar.yochpaz/cve-2026-2256-from-ai-prompt-to-full-system-compromise-a4114c718326
- https://github.com/Itamar-Yochpaz/CVE-2026-2256-PoC
- https://www.kb.cert.org/vuls/id/431821
More modelscope vulnerabilities
- TI-2024-32252 In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the… CVSS 3.1CRITICAL 9.8
- TI-2024-07882 Remote Code Execution via Deserialization in modelscope/agentscope CVSS 3.0CRITICAL 9.8
- TI-2024-07927 Path Traversal in modelscope/agentscope CVSS 3.1CRITICAL 9.1
- TI-2024-07914 Path Traversal in modelscope/agentscope CVSS 3.0CRITICAL 9.1
- TI-2024-07881 Arbitrary File Download in modelscope/agentscope CVSS 3.1HIGH 8.8
- TI-2024-07869 CORS Vulnerability in modelscope/agentscope CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-2256 · CVE Program
- CVE-2026-2256 · NVD
- FIRST EPSS
- GHSA-4gc2-344q-r2rw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2256 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences