An arbitrary code execution vulnerability was identified in ModelScope 1.25.0. The flaw arises when an attacker crafts a malicious entry for the ['nnet']['module'] key in the dey_mini.yaml configuration file. By inserting an attacker‑controlled module definition, the application loads and executes code that is under the attacker’s control, potentially compromising the entire system.

ModelScope, version 1.25.0, is affected. No other vendors or product versions are listed in the CNA data, and no additional affected releases are known at this time.

The vulnerability carries the risk of arbitrary code execution, a high‑severity outcome. The CVSS score of 7.3 indicates a high‑severity risk, while the EPSS score is unavailable. The fact that code can be executed through configuration manipulation makes the exploit potentially severe. Attackers would need the ability to write to the dey_mini.yaml file or otherwise influence its contents, suggesting that the risk is greatest in environments where configuration files are writable by untrusted users or processes. The vulnerability is not yet listed in the CISA KEV catalog, indicating no known active exploitation at this point.