CVE-2026-33625 in LMDeploy
Summary
by MITRE • 09/18/2026
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in LMDeploy versions through 0.12.2 represents a critical code injection flaw rooted in the unsafe handling of configuration parameters during model loading operations. LMDeploy serves as a specialized toolkit designed for compressing, deploying, and serving large language models, facilitating efficient inference workflows. However, within this ecosystem, the module located at lmdeploy/pytorch/config.py contains a specific implementation error on line 620 that compromises the integrity of the execution environment. The core technical flaw lies in the direct use of Python's eval function to process the quant_dtype attribute extracted from a model configuration file. Specifically, when an attacker publishes a malicious HuggingFace model containing a crafted quantization_config.quant_dtype value, this input is passed directly into an eval statement formatted as torch.{quant_dtype}. Because there are no validation checks or sanitization routines applied to the content of quant_dtype before evaluation, the Python interpreter executes whatever code string is provided by the attacker. This mechanism effectively bypasses standard security controls that would normally restrict execution to predefined library functions, allowing for arbitrary command execution within the context of the user's application running LMDeploy.
From a technical perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script, commonly known as code injection. The attacker leverages the trust placed in configuration files to inject malicious payloads that are interpreted by the Python runtime environment. When a user loads such a compromised model using LMDeploy, the system attempts to resolve the torch module attribute specified in the quant_dtype field. By supplying a value containing additional Python statements or function calls separated by semicolons or newlines, an attacker can execute arbitrary commands on the host machine. This could lead to data exfiltration, installation of backdoors, privilege escalation if the process runs with elevated permissions, or complete compromise of the underlying infrastructure hosting the model serving pipeline. The severity is heightened because HuggingFace models are often treated as trusted sources by developers integrating them into production systems, leading to a false sense of security regarding configuration file contents.
The operational impact of this vulnerability extends beyond simple code execution to significant risks in machine learning deployment pipelines. Organizations relying on LMDeploy for serving large language models may inadvertently expose their infrastructure to remote code execution attacks simply by loading a community-contributed model that has been tampered with. In enterprise environments where these services run as daemons or within containerized microservices, the compromise of one instance can lead to lateral movement across the network if proper isolation measures are not in place. Furthermore, since large language models often process sensitive data, an attacker gaining code execution capabilities could potentially intercept inputs and outputs, leading to severe privacy breaches. The attack vector is particularly dangerous because it does not require user interaction beyond the initial model loading step, making it suitable for automated exploitation campaigns targeting public model repositories or internal model registries that lack rigorous validation protocols.
To mitigate this risk, organizations must immediately upgrade LMDeploy to version 0.12.3 or later, which contains a patch addressing this code injection flaw by implementing proper input validation and restricting the eval function's scope or replacing it with safer alternatives such as direct attribute access via getattr. In environments where upgrading is not immediately feasible, administrators should implement strict allowlists for quantization data types at the application level before passing them to LMDeploy functions. Additionally, adopting a zero-trust approach to model ingestion involves scanning HuggingFace models and other external repositories for suspicious configuration files prior to deployment. Security teams should also enforce least-privilege principles by running inference services in isolated containers with restricted system access limits. Monitoring logs for unusual process creation or network connections originating from the LMDeploy service can aid in early detection of exploitation attempts. This incident underscores the importance of treating all external inputs, including configuration metadata, as untrusted data that requires rigorous sanitization and validation before processing by dynamic code execution mechanisms.