| Título | InternScience InternAgent commit fa8c3eedfa9751d3752ea6eb49220b303ac2397d (main HEAD as of 2026-07-29) Improper Input Validation |
|---|
| Descripción | A vulnerability was found in InternAgent commit fa8c3eedfa9751d3752ea6eb49220b303ac2397d and classified as medium 4.5. Affected is the train() function of the tasks/AutoChem/code/experiment.py component (LoRA loading block, lines 251-255). The manipulation of the argument base_model_name_or_path in adapter_config.json of a supplied LoRA adapter leads to improper input validation: the value is passed to AutoModel.from_pretrained() without checking it against the operator-provided base model, so a crafted adapter redirects the training pipeline to an attacker-chosen Hugging Face Hub repository whose configuration and SafeTensors weights are fetched over the network and assembled into the PEFT training model. It is possible to launch the attack remotely. User interaction is required in that a victim must run fine-tuning with the crafted adapter. The attacker repository is data-only (no .py sidecar, remote code not enabled), so the impact is model-provenance poisoning (integrity of trained artifacts), not code execution.
Technical Details
- Affected file/function: tasks/AutoChem/code/experiment.py / train() lines 251-255 (same pattern in tasks/AutoChem/run_0/experiment.py lines 261-265)
- Vulnerable parameter: base_model_name_or_path field of adapter_config.json in the LoRA adapter directory passed via --lora_adapter_path
- Attack vector: Network
- Privileges required: None (sharing the adapter file is sufficient)
- Trigger condition: victim loads a shared/crafted LoRA adapter in the AutoChem training task while use_lora is enabled and the adapter directory exists; PeftConfig.from_pretrained() reads the field and AutoModel.from_pretrained() fetches the declared base repository
Impact
- Confidentiality: None (no data leaves the host)
- Integrity: Low (attacker-selected base weights and base configuration silently become the foundation of the fine-tuning run; model poisoning / provenance subversion, no code execution)
- Availability: None (the run completes normally)
CVSS v3.1
Score: 4.5 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Timeline
- Discovered: [unknown]
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Treat the adapter-declared base model as untrusted data at tasks/AutoChem/code/experiment.py:254: prefer the operator-provided --pretrained_model_path, fail or warn on mismatch, restrict accepted values to an allowlist of local paths, trusted namespaces or pinned commit hashes, and apply the same change to the copied script tasks/AutoChem/run_0/experiment.py. |
|---|
| Fuente | ⚠️ https://github.com/InternScience/InternAgent/issues/30 |
|---|
| Usuario | Dem000000 (UID 98564) |
|---|
| Sumisión | 2026-10-09 19:05 (hace 14 días) |
|---|
| Moderación | 2026-10-23 17:07 (14 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 425984 [InternScience InternAgent 1.5.0 LoRA Loading experiment.py train base_model_name_or_path escalada de privilegios] |
|---|
| Puntos | 20 |
|---|