CVE-2025-51427

HighCVSS 7.3

Published: 19/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

41th percentile - higher than 41% of all known CVEs

Summary

In ModelScope 1.25.0, a vulnerability was found allowing attackers to execute arbitrary code via a crafted module specified in the configuration file dey_mini.yaml under the key ['nnet']['module'].

Risk Assessment

The risk involves remote code execution by an attacker, potentially leading to system compromise, data theft, or lateral movement within the organization's network.

Recommendation

Immediately update ModelScope to the latest patched version and restrict access to configuration files to trusted users only.

Original NVD description (English source)

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].