What is the CVSS score of CVE-2025-51427?

CVE-2025-51427 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of ModelScope are affected by CVE-2025-51427?

Alibaba ModelScope 1.25.0 is vulnerable to remote code execution when loading malicious model repositories, with publicly available exploit code but no confirmed active exploitation to date.. A patch is available.

How to fix or mitigate CVE-2025-51427?

Within 24 hours, identify all systems running Alibaba ModelScope 1.25.0 and begin testing the patched version in a development environment. Within 7 days, deploy and validate the patched version in non-production environments, confirming that audio and machine learning inference pipelines function correctly. Within 30 days, complete production deployment across all systems and review logs for any suspicious external model repository access or unexpected Python module loading from model configuration files during the vulnerable period.

ModelScope CVE-2025-51427

EUVD-2025-209897 HIGH

Code Injection (CWE-94)

2026-05-19 mitre

GHSA-fhhq-h4hg-549x

RCE Code Injection N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

8.8 HIGH

Loading an attacker-supplied model is required (UI:R) but needs no authentication (PR:N); arbitrary Python execution in the victim process yields full C/I/A (H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 17:59 vuln.today

Analysis Generated

Jul 23, 2026 - 17:59 vuln.today

CVE Published

May 19, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

May 19, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].

AnalysisAI

Arbitrary code execution in Alibaba ModelScope 1.25.0 allows attackers to run attacker-controlled Python by publishing or supplying a malicious model repository whose configuration file (dey_mini.yaml) names a hostile module under the ['nnet']['module'] key, which the library imports/executes when a victim loads the model (notably via the linear AEC audio pipeline). This is a classic 'trust_remote_code' code-injection flaw (CWE-94): the framework executed repo-supplied module paths without requiring the user to opt into trusting remote code. Publicly available exploit code exists (independent disclosure write-up and vendor issue/PR), but there is no public evidence of active exploitation; EPSS is very low at 0.03% (8th percentile).

Technical ContextAI

ModelScope is an open-source 'Model-as-a-Service' library (developed by Alibaba) that downloads and instantiates ML models and pipelines from a model hub. Models ship with YAML configuration that declares which Python module implements the network/pipeline; here, dey_mini.yaml specifies ['nnet']['module'], and the linear_aec_pipeline (and base model/pipeline loaders) dynamically imported and executed that module. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): a repo-controlled string is used to import and run code with no trust boundary. The fix (PR #1333) introduces a trust_remote_code flag and a check_trust_remote_code() gate in modelscope/models/base/base_model.py and modelscope/pipelines/base.py, asserting trust_remote_code=True before importing extra libs or executing code defined in a model repo - the same defensive pattern Hugging Face Transformers uses. The CPE in the feed (cpe:2.3:a:n/a:n/a) is a placeholder and does not identify the product; identification relies on the description and GitHub evidence.

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed in the provided data - the fix is delivered via GitHub PR https://github.com/modelscope/modelscope/pull/1333, which adds a trust_remote_code gate, so upgrade to the first ModelScope release that includes that PR (verify the tagged version against the vendor changelog before deploying, and do not rely on the '1.25.0' number as fixed). After upgrading, treat trust_remote_code as a security boundary: keep it False (the new default) and only set it True for model repositories you have audited. As a compensating control until patched, do not load ModelScope models from untrusted or unverified publishers, pin/mirror only vetted model repos, and inspect any model's dey_mini.yaml (and other configs) for a suspicious ['nnet']['module'] value before loading; run model-loading workloads in a sandboxed, least-privilege container with no outbound network and no access to secrets so that code execution is contained. Trade-off: restricting to vetted repos and sandboxing reduces convenience and may break pipelines (e.g., linear AEC) that legitimately rely on remote module loading, which will now require an explicit trust_remote_code=True.