ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
Priority HIGH 73CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-502.
Summary
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00682 52nd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| modelscope | modelscope | up to 1.40.0 | — | No fix listed | CNA |
- modelscope Vendormodelscope Affected up to 1.40.0 Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
Not affected: 2 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84202
- 2026-10-03 Alias added: GHSA-pq5m-26pg-cxxp
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
References
Other 4
More modelscope vulnerabilities
- TI-2024-32252 In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the… CVSS 3.1CRITICAL 9.8
- TI-2024-07882 Remote Code Execution via Deserialization in modelscope/agentscope CVSS 3.0CRITICAL 9.8
- TI-2024-07927 Path Traversal in modelscope/agentscope CVSS 3.1CRITICAL 9.1
- TI-2024-07914 Path Traversal in modelscope/agentscope CVSS 3.0CRITICAL 9.1
- TI-2024-07881 Arbitrary File Download in modelscope/agentscope CVSS 3.1HIGH 8.8
- TI-2024-07869 CORS Vulnerability in modelscope/agentscope CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-84202 · CVE Program
- CVE-2026-84202 · NVD
- FIRST EPSS
- GHSA-pq5m-26pg-cxxp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84202 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences