# CVE-2025-51427: ModelScope remote code execution in LinearAECPipeline

Source: https://junglewise.ai/threats/cve-2025-51427-modelscope-remote-code-execution-in-linearaecpipeline  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2025-51427 · Severity: high · CVSS 7.3 · Published 2026-05-19

ModelScope is an open-source platform and library for machine learning models. A vulnerability in how it handles certain model configuration files allows an attacker to execute malicious code on a user's system. This occurs when a user downloads and runs a specially crafted model from an untrusted source, potentially leading to a full system compromise or data theft.

Vendors: [Alibaba](https://junglewise.ai/threats/vendors/alibaba), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-51427 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-51427 being exploited in the wild.

**How severe is CVE-2025-51427?** High severity, with a CVSS score of 7.3, published 19 May 2026.

**Which products and versions are affected?** Alibaba ModelScope < 1.27.0, 1.25.0; modelscope (PyPI) ECOSYSTEM:introduced=0,fixed=1.27.0.

**Is there a fix for CVE-2025-51427?** Yes. modelscope (PyPI): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-51427 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-51427?** Check whether you run Alibaba ModelScope or modelscope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- modelscope (PyPI): upgrade to 1.27.0 or later

  ```sh
  pip install "modelscope>=1.27.0"
  ```


## Technical details

A code injection vulnerability exists in ModelScope's LinearAECPipeline component due to unsafe use of importlib.import_module(). When initializing a model for the 'acoustic-echo-cancellation' task, the framework reads the 'dey_mini.yaml' configuration file and directly passes the value of the ['nnet']['module'] key to the dynamic import function. An attacker can exploit this by providing a malicious model repository containing a crafted configuration file that points to arbitrary Python code. This results in Remote Code Execution (RCE) when a victim loads the model using the pipeline API. The issue is addressed in version 1.27.0 by implementing a 'trust_remote_code' mechanism.

## Affected products

- Alibaba ModelScope < 1.27.0

## Identifiers

- CVE-2025-51427
- GHSA-fhhq-h4hg-549x
- PYSEC-2026-2663

## Timeline

- 2025-05-09: disclosed: Issue first reported on GitHub
- 2025-05-13: patched: Fix merged into master branch
- 2026-05-19: advisory: GitHub Advisory and CVE published

## References

- [https://github.com/modelscope/modelscope/issues/1331](https://github.com/modelscope/modelscope/issues/1331)
- [https://github.com/modelscope/modelscope/pull/1333](https://github.com/modelscope/modelscope/pull/1333)
- [https://github.com/JIRUWOZHI/vulnerability-disclosure/blob/main/CVE-2025-51427/CVE_2025_51427.md](https://github.com/JIRUWOZHI/vulnerability-disclosure/blob/main/CVE-2025-51427/CVE_2025_51427.md)
- [https://github.com/modelscope/modelscope/commit/75d54927e112261d39598ca08c15b66a7ff3f735](https://github.com/modelscope/modelscope/commit/75d54927e112261d39598ca08c15b66a7ff3f735)