CVE-2026-2256
NoneCVSS
—
EPSS
1.7%
Published
Mar 2, 2026
CISA due date
—
The record
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | ms-agent | 0 | No fix |