modelscope ms-agent vulnerabilities

Latest modelscope ms-agent CVEs

Newest publication first

1. CVE-2026-2256 Command injection vulnerability in ModelScope's ms-agent

   Published 2026-03-02

   Medium·CVSS 6.5 EPSS 2.1% PoC

   A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.