Executive brief
LMDeploy is a toolkit for deploying large language models. An attacker can trigger remote code execution by publishing a malicious model on HuggingFace Hub that contains a crafted quantization config. When a user loads the model with LMDeploy, arbitrary Python code embedded in the config is executed with the user's privileges, enabling full system compromise.
Technical details
The vulnerability is a code injection flaw in lmdeploy/pytorch/config.py line 620, where the quant_dtype parameter from a model's quantization_config is passed directly to eval(f'torch.{quant_dtype}') without validation. The quant_dtype value originates from a HuggingFace model's configuration file and is not sanitized, even though a similar torch_dtype parameter has a whitelist check. An attacker can craft a model with a quant_dtype value containing arbitrary Python code (e.g., "float16, __import__('os').system('id')"). The attack requires only that a user loads the malicious model via LMDeploy's standard APIs; no user interaction beyond that is needed, making this a supply-chain attack vector.
Affected products
- InternLM LMDeploy all versions up to and including latest
Timeline
- 2026-09-18: disclosed