ModelScope EUVD-2026-69289

Exploitation requires the victim to actively load a model from an attacker-controlled repository using the ModelScope SDK - specifically via code paths that invoke yaml.Loader in the audio TTS (voice.py) or multimodal mPLUG (configuration_mplug.py) modules; other yaml.Loader usages in the codebase may introduce additional paths. No special server-side configuration is required; the vulnerability triggers client-side during the model initialization workflow. Limiting factors: the victim must explicitly load or initialize the malicious model (UI:P), meaning automated pipelines that load only pinned, cryptographically hash-verified model versions from internally mirrored registries are not exploitable under normal operation. Exploitation is entirely prevented if yaml.SafeLoader is substituted, or if the affected model categories (TTS audio, mPLUG multimodal) are not used in the environment. No race condition, timing dependency, or non-default OS configuration is required - attack complexity is low (AC:L, AT:N) once the model load is triggered.

The CVSS 4.0 score of 8.7 reflects a high-severity, network-accessible, low-complexity vulnerability requiring only passive user interaction (UI:P - the victim must load a model). The impact triad is fully high (VC:H/VI:H/VA:H), meaning successful exploitation grants the attacker complete control over the victim process and host environment. No EPSS score or KEV listing is available, and no public exploit has been identified at time of analysis, which moderates immediate operational urgency relative to actively-exploited CVEs. However, the attack class - unsafe YAML deserialization - is exceptionally well understood, and proof-of-concept payloads for yaml.Loader are trivially constructed from publicly documented techniques, making exploitation effectively low-complexity once a user loads the malicious model. Organizations running ML pipelines that automatically pull models from public ModelScope repositories face elevated risk; even a mid-sized data engineering team in swidnica operating model-serving or MLOps infrastructure should treat this as a priority remediation rather than a low-probability theoretical concern. The absence of scope change (SC:N/SI:N/SA:N) limits blast radius to the vulnerable system, but ML workstations and inference servers typically hold high-value assets including model weights, training datasets, and cloud provider credentials.

An attacker creates a public model repository on ModelScope's hosting platform and embeds a crafted YAML configuration file containing a !!python/object/apply:os.system payload targeting a reverse shell or credential exfiltration command. A data scientist or ML engineer loads this model using the ModelScope SDK, triggering yaml.Loader deserialization of the configuration file, which executes the embedded payload immediately on their workstation under their user privileges with no further attacker interaction required.