CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2025-51427
High (7.3). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in modelscope 1.27.0.
An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-94, CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fhhq-h4hg-549x | PyPI | modelscope | <1.27.0 | 1.27.0 |
| PYSEC-2026-2663 | PyPI | modelscope | <1.27.0 | 1.27.0 |
References
- https://github.com/JIRUWOZHI/vulnerability-disclosure/blob/main/CVE-2025-51427/CVE_2025_51427.md
- https://github.com/modelscope/modelscope/issues/1331
- https://github.com/modelscope/modelscope/pull/1333
- https://access.redhat.com/security/cve/CVE-2025-51427
- https://bugzilla.redhat.com/show_bug.cgi?id=2479894