CVE-2026-2256

MEDIUM

ModelScope ms-agent <v1.6.0rc1 - Command Injection

Title source: llm

Description

A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

References (5)

Scores

CVSS v3 6.5
EPSS 0.0231
EPSS Percentile 84.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Classification

CWE
CWE-77
Status draft

Affected Products (1)

pypi/ms-agent PyPI

Timeline

Published Mar 02, 2026
Tracked Since Mar 03, 2026