{"id":"CVE-2025-51427","aliases":["GHSA-fhhq-h4hg-549x","PYSEC-2026-2663"],"title":"ModelScope is vulnerable to arbitrary code injection via a crafted module","summary":"ModelScope is vulnerable to arbitrary code injection via a crafted module","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendor":"modelscope","product":"modelscope","ecosystem":"pip","affected":["modelscope < 1.27.0"],"patched":["modelscope 1.27.0"],"published":"2026-05-19","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fhhq-h4hg-549x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-51427"},{"url":"https://github.com/modelscope/modelscope/issues/1331"},{"url":"https://github.com/modelscope/modelscope/pull/1333"},{"url":"https://github.com/modelscope/modelscope/commit/75d54927e112261d39598ca08c15b66a7ff3f735"},{"url":"https://github.com/JIRUWOZHI/vulnerability-disclosure/blob/main/CVE-2025-51427/CVE_2025_51427.md"},{"url":"https://github.com/modelscope/modelscope"}],"tags":["osv","pip"],"epss":0.00522,"epssPercentile":0.43345,"ingestedAt":"2026-07-13T18:57:57.375Z","slug":"CVE-2025-51427","body":"## Overview\n\nAn issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].\n\n## Affected packages\n\n- `modelscope < 1.27.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `modelscope 1.27.0`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}