An arbitrary code execution vulnerability exists in ModelScope 1.25.0. The flaw allows an attacker to create a malicious entry under the ['nnet']['module'] key in the dey_mini.yaml configuration file, causing the application to load and run code supplied by the attacker. This can compromise the confidentiality, integrity, and availability of the host system.

ModelScope version 1.25.0 is affected. No additional vendors or product versions are listed in CNA data, and no other releases are known to be impacted.

The CVSS score of 7.3 indicates a high severity risk. The EPSS score is less than 1%, suggesting that exploitation is considered unlikely, yet the vulnerability is still present. Because the code is executed through manipulated configuration, the attack requires write access to dey_mini.yaml or the ability to influence its contents, which may be possible in environments where configuration files are writable by untrusted users or processes. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation at this time.