A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands t…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com
• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 2, 2026 · NIST NVD

   Detected

   A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

2. Jun 17, 2026 · NIST NVD

   Updated

   A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

Sources

• NIST NVDVulnerability recordCVE-2026-2256

  A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · medium.com
• Reference · hiddenlayer.com
• Reference · kb.cert.org