This vulnerability in ModelScope 1.25.0 arises from improper handling of the module specified in the configuration file dey_mini.yaml under the ['nnet']['module'] key. An attacker can craft this module entry to execute arbitrary code within the context of the application. The issue is documented as CVE-2025-51427 but lacks a CVSS score and official remediation details. No exploits have been reported publicly, and the affected versions are not explicitly detailed beyond 1.25.0.

Successful exploitation allows an attacker to execute arbitrary code on the system running ModelScope 1.25.0, potentially leading to full compromise of the affected environment. Since the vulnerability involves code execution via configuration manipulation, it could be leveraged to run malicious payloads if an attacker can modify or influence the configuration file. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the configuration file (dey_mini.yaml) to trusted users only and monitor for unauthorized changes. Avoid using untrusted modules or configurations. Follow vendor channels for updates on patches or mitigations.