> CVE-2026-2256

« BACK_TO_HOME
PUBLISHED
2026-03-02 21:16
MODIFIED
2026-03-02 21:16
EPSS (Prob. Exploit)
2.05%
Top 18.6%
DATA SOURCES:
NVD 🔗 2026-03-02 RED HAT 🔗 2026-03-08 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-08

> DESCRIPTION

A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> GITHUB SECURITY ADVISORY

GHSA-4gc2-344q-r2rw MODERATE

MS-Agent vulnerable to Command Injection

AFFECTED PACKAGES:
PIP / ms-agent
<= 1.6.0rc1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Command injection vulnerability in ModelScope's ms-agent

AFFECTED PACKAGES:
Unknown / Unknown
17 versions affected
ALIASES:
GHSA-4gc2-344q-r2rw, PYSEC-2026-2668

> HISTORIQUE DES MODIFICATIONS

Première apparition
02/03/2026 21:16
Source: NVD
📊 ENRICHISSEMENT 08/03/2026 05:01
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 08/03/2026 05:01
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 2 Dernière mise à jour: 8 months ago

> REFERENCES

https://github.com/Itamar-Yochpaz/CVE-2026-2256-PoC
https://github.com/modelscope/ms-agent
https://medium.com/@itamar.yochpaz/cve-2026-2256-from-ai-prompt-to-full-system-c...
https://www.hiddenlayer.com/research/indirect-prompt-injection-of-claude-compute...
« BACK_TO_HOME