Vancir

ModelScope uses PyYAML's unsafe `yaml.Loader` to parse model configuration files. This allows arbitrary code execution through Python object construction tags, enabling attackers to craft malicious model repositories with poisoned configuration files that execute code when loaded by users.

A bypass of the `trust remote code` security gate in the `DiffusionPipeline.from pretrained()` function allows arbitrary remote code execution, even when `trust remote code` is set to `False` or left as default. This occurs because the security check was implemented within the `DiffusionPipeline.download()` function rather than at the dynamic-module load site, allowing any code path that bypasses `download()` to execute untrusted code. This manifests in three scenarios: when a `custom pipeline` is loaded from a different repository than the primary model, when a local snapshot is used with a Hub-based `custom pipeline`, or when a local snapshot contains custom component files referenced in `model index.json`.