CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
Attackers can execute arbitrary code by crafting malicious model configuration files that exploit unsafe YAML deserialization in ModelScope.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-84202?
CVE-2026-84202 is a high-severity unsafe deserialization vulnerability in modelscope, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users.
Weakness: CWE-502
Which versions are affected by CVE-2026-84202?
Linux distribution packages (2)
python-modelscope openSUSE:Tumbleweed | All versions | 1.40.0-1.1 |
python-modelscope-hub openSUSE:Tumbleweed | All versions | 0.4.2-1.1 |
How do I fix CVE-2026-84202?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-84202 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84202 exists.
Sources
Also known as GHSA-pq5m-26pg-cxxp, openSUSE-SU-2026:11736-1, openSUSE-SU-2026:11746-1.