GHSA-fhhq-h4hg-549x

ModelScope is vulnerable to arbitrary code injection via a crafted module

Source: GitHub Advisory Database (reviewed) High CVE-2025-51427

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	modelscope	< 1.27.0	1.27.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-51427 advisory
https://github.com/modelscope/modelscope/issues/1331 web
https://github.com/modelscope/modelscope/pull/1333 web
https://github.com/modelscope/modelscope/commit/75d54927e112261d39598ca08c15b66a7ff3f735 web
https://github.com/JIRUWOZHI/vulnerability-disclosure/blob/main/CVE-2025-51427/CVE_2025_51427.md web
https://github.com/modelscope/modelscope package