A critical deserialization vulnerability in ModelScope allows unauthenticated attackers to achieve remote code execution by providing a maliciously crafted model configuration file.

The application uses PyYAML's unsafe yaml.Loader to parse configuration files. This flaw allows an attacker to execute arbitrary code during the deserialization of untrusted YAML data, which is triggered when a user loads a poisoned model repository.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the host system with the privileges of the application process. This can lead to full system compromise, unauthorized data exfiltration, or the deployment of persistent threats within the development or production environment. With a CVSS score of 8.8, this vulnerability represents a high-risk vector for supply chain attacks against users of the ModelScope platform.

Immediate Action: Update the ModelScope software to the latest version, which replaces unsafe YAML loading practices with secure alternatives. If an update is not immediately available, restrict the loading of models to only trusted and verified sources.

Proactive Monitoring: Monitor system logs for unexpected child processes or abnormal outbound network connections initiated by the ModelScope application. Review access logs for any evidence of unauthorized interaction with model repositories or configuration file uploads.

Compensating Controls: Implement strict file integrity monitoring on model configuration files to detect unauthorized modifications. Utilize containerization or sandboxing to isolate the execution environment of the ModelScope application, thereby limiting the impact of a potential compromise.

Public Exploit Available: No

Given the potential for remote code execution and the existence of credible proof-of-concept evidence, organizations using ModelScope must treat this vulnerability with high urgency. Administrators should prioritize upgrading to a patched version of the software immediately and ensure that all model repository ingestion processes are strictly controlled to prevent the introduction of untrusted configuration files.