Executive brief
ModelScope is an open-source platform and library for machine learning models. A vulnerability in how it handles certain model configuration files allows an attacker to execute malicious code on a user's system. This occurs when a user downloads and runs a specially crafted model from an untrusted source, potentially leading to a full system compromise or data theft.
Technical details
A code injection vulnerability exists in ModelScope's LinearAECPipeline component due to unsafe use of importlib.import_module(). When initializing a model for the 'acoustic-echo-cancellation' task, the framework reads the 'dey_mini.yaml' configuration file and directly passes the value of the ['nnet']['module'] key to the dynamic import function. An attacker can exploit this by providing a malicious model repository containing a crafted configuration file that points to arbitrary Python code. This results in Remote Code Execution (RCE) when a victim loads the model using the pipeline API. The issue is addressed in version 1.27.0 by implementing a 'trust_remote_code' mechanism.
Affected products
- Alibaba ModelScope < 1.27.0
Timeline
- 2025-05-09: disclosed: Issue first reported on GitHub
- 2025-05-13: patched: Fix merged into master branch
- 2026-05-19: advisory: GitHub Advisory and CVE published