CVE-2026-84202

Name of the Vulnerable Software and Affected Versions ModelScope versions prior to 1.40.1

Description ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files. This allows arbitrary code execution through Python object construction tags, enabling attackers to craft malicious model repositories with poisoned configuration files that execute code when loaded by users.

Recommendations Update ModelScope to version 1.40.1 or later.