Arbitrary Code Execution in ModelScope via Insecure PyYAML Parsing

ModelScope is a machine learning model library that, in affected versions, improperly handles model configuration files. The vulnerability arises from the use of PyYAML's yaml.Loader (often referred to as the unsafe loader) to deserialize configuration files. By crafting a model repository that includes a maliciously formatted configuration file containing specific Python object construction tags (e.g., !!python/object/apply), an attacker can trigger arbitrary code execution within the context of the user or system loading the model. This impact is significant for organizations relying on ModelScope to pull and execute machine learning models from external or potentially untrusted repositories, as the mere act of loading a configuration file becomes a primary vector for host compromise.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the process running the ModelScope framework. This can lead to full host compromise, exfiltration of sensitive data, or lateral movement within the network. Users of the library who automatically ingest models from public or unvetted sources are at the highest risk.

Recommendation

Prioritized actions for security and engineering teams:

• Update the ModelScope library to the latest version, which removes the use of the unsafe yaml.Loader in favor of yaml.SafeLoader for configuration parsing.
• Audit all model repository sources currently in use to ensure they originate from trusted entities only.
• Implement strict sandboxing for any machine learning processes that ingest configuration data from unverified model repositories.