modelscope (>=1.9.0, <=1.9.1), scepter (>=0.0.1, <=1.0.3) potentially affected by CVE-2026-10801 via ms-swift (>=1.3.0, <=2.2.5)

ms-swift PYPI version =1.3.0, =1.9.0, =0.0.1, =1.0.3 Source cves: CVE-2026-10801 Source advisory: SNYK:PYTHON-MSSWIFT-17152951...

CVE-2026-10801

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

CVE-2026-10801 modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

EUVD-2026-34242

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

CVE-2026-10801 modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

CVE-2026-10801

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

modelscope (>=1.9.0, <=1.9.1), scepter (>=0.0.1, <=1.0.3) potentially affected by CVE-2026-10801 via ms-swift (>=1.3.0, <=2.2.5)

ms-swift PYPI version =1.3.0, =1.9.0, =0.0.1, =1.0.3 Source cves: CVE-2026-10801 Source advisory: MEND:CVE-2026-10801...

CVE-2026-10801

CVE-2026-10801 affects modelscope ms-swift up to 4.2.0 and targets the PIL Image Cache Key Handler, specifically the function Template._save_pil_image in swift/template/base.py. The issue is a manipulation that results in the use of a weak hash, enabling a local attack. The CVE notes a high attac...

CVE-2026-10801 modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

CVE-2026-10801: Use of Weak Hash

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

PT-2026-46180

Name of the Vulnerable Software and Affected Versions modelscope ms-swift versions prior to 4.2.1 Description The PIL Image Cache Key Handler component contains an issue where the Template. save pil image function in the swift/template/base.py file uses a weak hash. Exploitation requires local...

PT-2026-58981

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template. save pil image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A...

ModelScope security vulnerabilities

ModelScope is an open-source model service and inference training platform developed by ModelScope. Versions of ModelScope 4.2.0 and earlier contain security vulnerabilities. These vulnerabilities stem from the use of a weak hash function in the Template.savepilimage function of the...

CVE-2025-51427

A flaw was found in ModelScope. This vulnerability allows a remote attacker to execute arbitrary code by providing a specially crafted module within the configuration file deymini.yaml under the 'nnet.module' key. Successful exploitation could lead to complete system compromise...

Arbitrary Code Execution

Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Execution from the pipeline interface. There, a user can supply a malicious model that loads arbitrary modules via an acoustic-echo-cancellation...

adaseq (0.4.0), artcraft (>=0.0.0, <=0.0.23) +20 more potentially affected by CVE-2025-51427 via modelscope (>=1.1.1, <=1.26.0)

modelscope PYPI version =1.1.1, =0.0.0, =0.5.4, =0.6.0rc1, =1.0.0, =0.4.0, =2.4.2, =0.6.2, =0.1.0, =0.1.2, =0.1.0, =0.5.0, =0.7.0 and more Source cves: CVE-2025-51427 Source advisory: SNYK:PYTHON-MODELSCOPE-17223769...

adaseq (0.4.0), artcraft (>=0.0.0, <=0.0.23) +20 more potentially affected by CVE-2025-51427 via modelscope (>=1.1.1, <=1.26.0)

modelscope PYPI version =1.1.1, =0.0.0, =0.5.4, =0.6.0rc1, =1.0.0, =0.4.0, =2.4.2, =0.6.2, =0.1.0, =0.1.2, =0.1.0, =0.5.0, =0.7.0 and more Source cves: CVE-2025-51427 Source advisory: GHSA-FHHQ-H4HG-549X...

ModelScope is vulnerable to arbitrary code injection via a crafted module

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file deymini.yaml under the key 'nnet''module'...

adaseq (0.4.0), artcraft (>=0.0.0, <=0.0.23) +20 more potentially affected by CVE-2025-51427 via modelscope (>=1.1.1, <=1.26.0)

modelscope PYPI version =1.1.1, =0.0.0, =0.5.4, =0.6.0rc1, =1.0.0, =0.4.0, =2.4.2, =0.6.2, =0.1.0, =0.1.2, =0.1.0, =0.5.0, =0.7.0 and more Source cves: CVE-2025-51427 Source advisory: OSV:GHSA-FHHQ-H4HG-549X...

GHSA-FHHQ-H4HG-549X ModelScope is vulnerable to arbitrary code injection via a crafted module

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file deymini.yaml under the key 'nnet''module'...