Researcher Itamar Yochpaz disclosed CVE-2026-2256, a command-injection vulnerability in ModelScope’s open-source MS-Agent framework (version 1.6.0rc1 and earlier). The agent’s built-in Shell tool relies on a regex-based denylist that can be bypassed using interpreters such as python3, allowing an attacker to run arbitrary OS commands through indirect prompt injection in content the agent processes. The flaw was coordinated through CERT/CC; no confirmed official patch was available at the time of public disclosure.