The flaw arises from ModelScope using PyYAML's unsafe yaml.Loader to read model configuration files. This allows an attacker to insert Python object construction tags that are instantiated when the file is parsed, giving the attacker arbitrary code execution on the system that loads the model. The vulnerability therefore enables a compromise that undermines confidentiality, integrity, and availability of the host environment.

The vulnerability is present in ModelScope version 1.40.0 and earlier, specifically the YAML parsing routines used by the audio TTS voice and multi‑modal mplug configuration modules. All users running version 1.40.0 of the ModelScope framework are exposed unless they upgrade to a later release that fixes the deserialization logic.

With a CVSS score of 8.7 the flaw is considered a high‑severity vulnerability. The EPSS score is not available, meaning the exploitation likelihood is unknown, but the presence of arbitrary code execution potential is alarming. The vulnerability is not listed in the CISA KEV catalog, yet the attack path—uploading a malicious model repository—could be leveraged in targeted or supply‑chain attacks.