HighVulnerability
GHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
- Identifiers
- CVE-2026-33625GHSA-3hmm-rh5q-gwwr
- Published
- Record updated
- Affected
- lmdeploy >= 0.12.1, < 0.12.3
- Fixed in
- 0.12.3
- released April 22, 2026, 149 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
LMDeploy, through its latest release, passes the quant_dtype value from a model's HuggingFace quantization_config directly into eval(f'torch.{quant_dtype}') at lmdeploy/pytorch/config.py line 620 with no validation. The AWQ branch does not override this value, so a malicious model can run arbitrary Python when loaded with lmdeploy. The advisory describes this as a supply-chain vector affecting any user who loads an untrusted model.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
- HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories
- MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
- MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
- HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database