LLMHigh
CVE-2026-2256: A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, al…
- Occurred
- Mar 2, 2026
- Published
- Mar 2, 2026
- Source
- NVD CVE
Summary
A command injection vulnerability in ModelScope's ms-agent versions v1.6.0rc1 and earlier exists, allowing an attacker to execute arbitrary operating system commands through crafted prompt-derived input.
Tags
- CVE
- CVE-2026-2256
- cvss:MEDIUM
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Command injection in LLM agent framework allows arbitrary OS command execution, posing significant security risk.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8