59 matches found
CVE-2025-50460
CVE-2025-50460: Remote Code Execution in modelscope/ms-swift via unsafe PyYAML deserialization Status: Awaiting Analysis This CVE record has been marked for NVD enrichment efforts. A remote code execution RCE vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization...
CVE-2025-50472
CVE-2025-50472 ModelScope Ms-Swift ModelFileSystemCache Deserialization of Untrusted Data Remote Code Execution Vulnerability RCE PoC I uploaded a code repository containing a malicious .mdl file to ModelScope for testing purposes. It can be used directly during testing. The link is:...
CVE-2026-85686
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
CVE-2026-85686
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
CVE-2026-85686
ms-swift 4.5.2 (ModelScope) contains an unauthenticated SSRF in the swift deploy OpenAI-compatible API. The vulnerable component is vision_utils.py, which fetches multimodal media URLs (image_url , audio_url , video_url ) without URL validation or redirect filtering. An attacker can supply arbitr...
EUVD-2026-71135
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
CVE-2026-85686: Server-Side Request Forgery (SSRF)
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary imageurl, audiourl, or videourl parameters to make the server...
PT-2026-85572
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image url, audio url, or video url parameters to make the serve...
ms-swift: Image Cache Hash Collision via Missing Dimension Metadata
A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...
scepter (0.0.1) potentially affected by CVE-2026-10801 via ms-swift (1.5.2)
ms-swift PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - scepter 0.0.1 Source cves: CVE-2026-10801 Source advisory: OSV:PYSEC-2026-3488...
scepter (1.0.3) potentially affected by CVE-2026-10801 via ms-swift (2.2.5)
ms-swift PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - scepter 1.0.3 Source cves: CVE-2026-10801 Source advisory: OSV:PYSEC-2026-3488...
modelscope (>=1.9.0, <=1.9.1) potentially affected by CVE-2026-10801 via ms-swift (1.3.0)
ms-swift PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - modelscope =1.9.0, =1.9.1 Source cves: CVE-2026-10801 Source advisory: OSV:PYSEC-2026-3488...
PT-2026-64098
A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template. save pil image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A...
modelscope (>=1.9.0, <=1.9.1) potentially affected by CVE-2025-41419 via ms-swift (1.3.0)
ms-swift PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - modelscope =1.9.0, =1.9.1 Source cves: CVE-2025-41419 Source advisory: OSV:PYSEC-2026-1682...
scepter (0.0.1) potentially affected by CVE-2025-41419 via ms-swift (1.5.2)
ms-swift PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - scepter 0.0.1 Source cves: CVE-2025-41419 Source advisory: OSV:PYSEC-2026-1682...
scepter (1.0.3) potentially affected by CVE-2025-41419 via ms-swift (2.2.5)
ms-swift PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - scepter 1.0.3 Source cves: CVE-2025-41419 Source advisory: OSV:PYSEC-2026-1682...
scepter (0.0.1) potentially affected by CVE-2025-50460 via ms-swift (1.5.2)
ms-swift PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on ms-swift and may be impacted: - scepter 0.0.1 Source cves: CVE-2025-50460 Source advisory: OSV:PYSEC-2026-1683...