Moderate severityNVD Advisory· Published Mar 2, 2026· Updated Mar 3, 2026
Command injection vulnerability in ModelScope's ms-agent
CVE-2026-2256
Description
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ms-agentPyPI | <= 1.6.0rc1 | — |
Affected products
2- Range: 0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-4gc2-344q-r2rwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-2256ghsaADVISORY
- medium.com/@itamar.yochpaz/cve-2026-2256-from-ai-prompt-to-full-system-compromise-a4114c718326ghsaWEB
- www.hiddenlayer.com/research/indirect-prompt-injection-of-claude-computer-useghsaWEB
- www.kb.cert.org/vuls/id/431821ghsaWEB
News mentions
0No linked articles in our index yet.