ModelScope, an AI model repository framework, uses PyYAML's unsafe yaml.Loader to parse model configuration files. This allows arbitrary code execution through Python object construction tags embedded in YAML files. Attackers can craft malicious model repositories containing poisoned configuration files that execute arbitrary code when loaded by unsuspecting users. The vulnerability affects ModelScope through version 1.40.0 and has been confirmed in multiple source files including voice.py and configuration_mplug.py. This represents a significant supply chain risk as users downloading and loading models from repositories could unknowingly execute malicious code. The issue is a classic unsafe deserialization vulnerability where yaml.Loader should be replaced with yaml.SafeLoader. Users and organizations relying on ModelScope for AI/ML workflows are advised to update immediately and audit any model configurations loaded from untrusted sources.
