The vulnerability CVE-2025-51427 affects ModelScope version 1.25.0. It allows remote attackers to execute arbitrary code by specifying a malicious module in the configuration file dey_mini.yaml under the ['nnet']['module'] key. This issue is associated with CWE-94 (Improper Control of Generation of Code) and CWE-502 (Deserialization of Untrusted Data). The CVSS v3.1 base score is 7.3, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level is currently provided by the vendor. The Red Hat advisory URL is available but does not specify a fix or mitigation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system running ModelScope 1.25.0. This could lead to compromise of confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided in the Red Hat advisory, users should monitor the vendor advisory for updates. Until a patch is available, avoid using untrusted configuration files or modules in ModelScope 1.25.0 to reduce risk.