CVE-2026-84202: ModelScope PyYAML RCE Vulnerability

CVE-2026-84202 Overview

ModelScope through version 1.40.0 contains an insecure deserialization vulnerability [CWE-502] in its model configuration loading logic. The library invokes PyYAML's unsafe yaml.Loader when parsing model configuration files, which permits Python object construction through YAML tags such as !!python/object/apply. An attacker who publishes a malicious model repository can execute arbitrary code on any machine that loads the model. The flaw affects loaders including the voice text-to-speech model in modelscope/models/audio/tts/voice.py and the MPLUG multi-modal configuration in modelscope/models/multi_modal/mplug/configuration_mplug.py.

Critical Impact
Arbitrary code execution in the context of the user loading a poisoned ModelScope model, leading to full host compromise, credential theft, and lateral movement into ML pipelines.

Affected Products

ModelScope framework through v1.40.0
modelscope.models.audio.tts.voice module
modelscope.models.multi_modal.mplug.configuration_mplug module

Discovery Timeline

2026-09-01 - CVE-2026-84202 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84202

Vulnerability Analysis

ModelScope loads YAML configuration files that ship inside model repositories using PyYAML's default yaml.Loader. That loader resolves arbitrary Python tags at parse time, so a YAML document can instruct the interpreter to call any importable callable with attacker-controlled arguments. Because ModelScope automatically fetches and parses configuration files when a user instantiates a model, no additional user interaction is required beyond loading the model by name.

The vulnerability class is insecure deserialization mapped to [CWE-502]. The Vulncheck advisory documents the unsafe loader usage across multiple configuration entry points in the ModelScope codebase. See the Vulncheck Advisory on ModelScope for the enumerated sinks.

Root Cause

The root cause is the use of yaml.load(stream) or yaml.Loader in place of yaml.safe_load or the SafeLoader. PyYAML's non-safe loaders recognize constructor tags like !!python/object/apply:os.system and instantiate the referenced Python objects during parsing. Both voice.py and configuration_mplug.py in the ModelScope v1.40.0 source tree parse configuration data without restricting the loader class.

Attack Vector

An attacker publishes a model repository containing a crafted configuration.yaml or equivalent config file. When a victim runs a standard ModelScope pipeline that references the malicious model identifier, ModelScope downloads the config and passes it to the unsafe loader. The embedded Python tag runs during deserialization with the privileges of the invoking process. The vector is network reachable and requires only that the user load the poisoned model, matching the pattern described in GitHub Issue #1660.

Because exploitation is triggered inside a Python interpreter, payloads commonly spawn a reverse shell, drop persistence, or exfiltrate cached Hugging Face and cloud provider tokens present on ML workstations and training nodes.

Detection Methods for CVE-2026-84202

Indicators of Compromise

Unexpected child processes spawned by python interpreters that have imported modelscope, particularly sh, bash, cmd.exe, powershell.exe, or curl.
YAML files inside model caches containing tags such as !!python/object, !!python/object/apply, !!python/name, or !!python/module.
Outbound network connections from ML workstations or training nodes immediately following a snapshot_download or pipeline() call.
New files written under ~/.cache/modelscope/hub/ combined with process execution originating from that directory.

Detection Strategies

Deploy YARA or regex rules against downloaded model artifacts to flag PyYAML Python-object tags in .yaml and .yml files.
Instrument Python environments to log calls into yaml.load and alert when the loader argument is Loader, FullLoader, or UnsafeLoader.
Correlate ModelScope download telemetry with subsequent process creation events to identify anomalous execution chains.

Monitoring Recommendations

Monitor endpoints running data science workloads for process lineage where python spawns shells or network utilities.
Track egress from GPU and training hosts to non-corporate destinations following model retrieval events.
Audit access to credential stores, cloud metadata endpoints, and SSH keys from ML service accounts.

How to Mitigate CVE-2026-84202

Immediate Actions Required

Inventory hosts, CI runners, and notebooks that import modelscope and identify installed versions.
Restrict ModelScope usage to an allowlist of trusted, internally vetted model identifiers.
Run ModelScope pipelines inside isolated containers or ephemeral VMs without access to production credentials.
Rotate any tokens, SSH keys, or cloud credentials cached on hosts that previously loaded untrusted models.

Patch Information

At the time of NVD publication, no fixed release was listed in the enriched data. Track the upstream ModelScope GitHub repository and GitHub Issue #1660 for a patched version that replaces yaml.Loader with yaml.SafeLoader across configuration parsers, including voice.py and configuration_mplug.py.

Workarounds

Fork ModelScope and replace all yaml.load(...) and yaml.Loader references with yaml.safe_load(...) or SafeLoader in configuration code paths.
Pre-scan downloaded model repositories for PyYAML Python tags before invoking pipeline() or model constructors.
Enforce egress network policies on ML build and training hosts to limit post-exploitation impact.
Execute ModelScope workloads under a dedicated, least-privileged service account with no access to secrets managers.

bash

# Configuration example: scan cached ModelScope configs for unsafe YAML tags
grep -REn --include='*.y*ml' \
  '!!python/(object|name|module|object/apply|object/new)' \
  ~/.cache/modelscope/hub/ || echo 'No unsafe YAML tags detected'