LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no publicly available patches.

Affected: PyPI: lmdeploy

## Summary

lmdeploy hardcodes `trust_remote_code=True` in multiple HuggingFace model-loading call sites.

The affected code paths are in:

```text lmdeploy/archs.py lmdeploy/utils.py ````

The vulnerable call sites pass `trust_remote_code=True` into HuggingFace Transformers APIs such as `AutoConfig.from_pretrained()`, `PretrainedConfig.get_config_dict()`, and `GenerationConfig.from_pretrained()`.

Because the model path is supplied by the operator or deployment configuration, an attacker who can control the `model_path` used by an lmdeploy serving process can point it to an attacker-controlled HuggingFace model repository. When lmdeploy starts and initializes the model, Transformers may download and execute remote Python code from that repository.

Successful exploitation results in arbitrary code execution with the privileges of the lmdeploy serving process.

## Affected version

Confirmed affected:

```text lmdeploy <= 0.12.3 ```

The issue was verified on `v0.12.3` and on `main`.

## Vulnerable code

Confirmed call sites:

```text lmdeploy/archs.py:154 AutoConfig.from_pretrained(..., trust_remote_code=True)

lmdeploy/archs.py:157 PretrainedConfig.get_config_dict(..., trust_remote_code=True)

lmdeploy/utils.py:225 GenerationConfig.from_pretrained(..., trust_remote_code=True) ```

The vulnerable pattern is:

```python AutoConfig.from_pretrained(model_path, trust_remote_code=True) ```

and:

```python GenerationConfig.from_pretrained(path, trust_remote_code=True) ```

The r…

Affected: PyPI: lmdeploy

## Summary

lmdeploy hardcodes `trust_remote_code=True` in multiple HuggingFace model-loading call sites.

The affected code paths are in:

```text lmdeploy/archs.py lmdeploy/utils.py ````

The vulnerable call sites pass `trust_remote_code=True` into HuggingFace Transformers APIs such as `AutoConfig.from_pretrained()`, `PretrainedConfig.get_config_dict()`, and `GenerationConfig.from_pretrained()`.

Because the model path is supplied by the operator or deployment configuration, an attacker who can control the `model_path` used by an lmdeploy serving process can point it to an attacker-controlled HuggingFace model repository. When lmdeploy starts and initializes the model, Transformers may download and execute remote Python code from that repository.

Successful exploitation results in arbitrary code execution with the privileges of the lmdeploy serving process.

## Affected version

Confirmed affected:

```text lmdeploy <= 0.12.3 ```

The issue was verified on `v0.12.3` and on `main`.

## Vulnerable code

Confirmed call sites:

```text lmdeploy/archs.py:154 AutoConfig.from_pretrained(..., trust_remote_code=True)

lmdeploy/archs.py:157 PretrainedConfig.get_config_dict(..., trust_remote_code=True)

lmdeploy/utils.py:225 GenerationConfig.from_pretrained(..., trust_remote_code=True) ```

The vulnerable pattern is:

```python AutoConfig.from_pretrained(model_path, trust_remote_code=True) ```

and:

```python GenerationConfig.from_pretrained(path, trust_remote_code=True) ```

The r…