GHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy (a tool for deploying large language models) has a critical vulnerability in how it loads model configurations from HuggingFace. When loading a model, the software uses eval() (a Python function that executes code from text) on an untrusted value called quant_dtype without checking if it's safe. An attacker can publish a malicious model on HuggingFace with crafted code hidden in the quant_dtype field, allowing them to run arbitrary commands on any computer that loads the model using LMDeploy.