Soumettre #1009706: LlamaChinese Llama-Chinese commit 6fa0fff Code Injection

A vulnerability was found in Llama-Chinese commit 6fa0fff and classified as high 8.8. Affected is the examples/chat_gradio_no_merge.py entry point (lines 87-96). The manipulation of the argument base_model_name_or_path in a PEFT LoRA adapter package (adapter_config.json) leads to code injection through an attacker-selected base-model source. It is possible to launch the attack remotely. User interaction is required because the victim must run the product's inference entry on an attacker-supplied adapter package.

Technical Details
- Affected file/function: examples/chat_gradio_no_merge.py / __main__ block, commit 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b (current main HEAD; file unchanged since 2024-01-30)
- Vulnerable parameter: base_model_name_or_path inside adapter_config.json, returned unmodified by PeftConfig.from_pretrained
- Attack vector: Network (adapter packages are distributed via model hubs or file shares)
- Privileges required: None
- Trigger condition: the operator starts python examples/chat_gradio_no_merge.py --model_name_or_path <adapter>; the script then loads the tokenizer and the base model from the adapter-controlled path and passes a hardcoded trust_remote_code=True, so transformers resolves the auto_map entry of the attacker-chosen second repository through get_class_from_dynamic_module and requests its custom modeling code. In a controlled test the second repository ships only config.json and tokenizer files, with auto_map pointing to a nonexistent module (modeling_missing.MissingForCausalLM); the OSError traceback proves that both the base-model redirect and the remote-code resolution were honored by the product. No Python sidecar ships in the tested package, and the finding is limited to the unvalidated redirect/authorization gap.

Impact
- Confidentiality: High (an attacker-chosen repository whose auto_map names an existing modeling file leads to arbitrary code import and execution in the victim process)
- Integrity: High (tokenizer and base model are silently substituted by attacker-chosen artifacts, corrupting the served model behavior)
- Availability: High (arbitrary imported code can crash or disable the service)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-30
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Do not treat base_model_name_or_path from an untrusted adapter config as a load path: require the operator to specify the base model explicitly or validate the adapter-declared base against a whitelist/signature; drop the hardcoded trust_remote_code=True and pin third-party loads to an immutable revision.

• La source: ⚠️ https://github.com/LlamaChinese/Llama-Chinese/issues/371
• Utilisateur: r1ck9 (UID 97869)
• Soumission: 01/10/2026 14:05 (il y a 18 jours)
• Modérer: 18/10/2026 16:09 (17 days later)
• Statut: Accepté
• Entrée VulDB: 421759 [LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module base_model_name_or_path élévation de privilèges]
• Points: 20