CVE-2026-84202: ModelScope unsafe YAML deserialization in model config parsing

CVE-2026-84202 · Severity: high · CVSS 8.8 · Published 2026-09-01

ModelScope is an open-source machine learning library that provides unified access to AI models for inference, training, and evaluation tasks. The library uses Python's unsafe YAML parser when loading model configuration files, allowing attackers to execute arbitrary code by crafting malicious model repositories. Users who load a poisoned model could have their systems compromised without additional interaction.

Quick answers

Is CVE-2026-84202 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84202 being exploited in the wild.
How severe is CVE-2026-84202?
High severity, with a CVSS score of 8.8, published 1 September 2026.
Which products and versions are affected?
ModelScope ModelScope <1.40.2.
Is there a fix for CVE-2026-84202?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84202 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84202?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, which permits arbitrary Python object construction through YAML tags. An attacker can craft a malicious model repository with a poisoned configuration file containing YAML deserialization gadgets that execute code during model loading. The vulnerability requires a user to load or download a malicious model, but no authentication is required and exploitation occurs automatically upon parsing the configuration. The impact is remote code execution in the context of the user running ModelScope. A fix would involve switching to yaml.SafeLoader or yaml.safe_load() to restrict deserialization to basic data types.

Affected products

  • ModelScope ModelScope <1.40.2

Timeline

  • 2026-09-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.