| Titolo | DAMO-NLP-SG VideoLLaMA2 commit c0bb03abf6b8a6b9a8dccac006fb4db5d4d9e414 (main HEAD) and tag v1.1 Download of Code Without Integrity Check |
|---|
| Descrizione | A vulnerability was found in DAMO-NLP-SG VideoLLaMA2 up to commit c0bb03abf6b8
(main HEAD, and tag v1.1) and classified as high 7.1. Affected is the
load_pretrained_model pretraining branch of videollama2/model/__init__.py
(lines 138-155), reached via the public videollama2.model_init entry point.
The manipulation of the argument _name_or_path in a model package's
config.json leads to a download of model artifacts without integrity check
(origin validation failure). It is possible to launch the attack remotely;
user interaction is required because the victim must load the crafted model
package.
Technical Details
- Affected file/function: videollama2/model/__init__.py:138-155 /
load_pretrained_model (pretraining branch), via videollama2/__init__.py:14
model_init (model_base fixed to None)
- Vulnerable parameter: `_name_or_path` string inside the checkpoint's
config.json (writer-controlled), reused as the second-hop repository id
- Attack vector: Network
- Privileges required: None (publishing the crafted package)
- Trigger condition: load a pretraining checkpoint (tune_mm_mlp_adapter=true)
without an explicit model_base; the loader fetches tokenizer files and
model.safetensors from the repository named in the package. The second-hop
repository needs only data files (JSON, tokenizer data, safetensors) - no
code sidecar. The code comment at lines 142-143 documents that
AutoConfig.from_pretrained() would have rewritten the field to the local
path (the safe behavior) and that PretrainedConfig is used instead.
Impact
- Confidentiality: None (the chain only downloads; nothing is uploaded)
- Integrity: High (the runtime model is silently built from attacker-chosen
tokenizer and weight files, fully determining model behavior)
- Availability: Low (attacker-chosen download size and model memory footprint)
CVSS v3.1
Score: 7.1 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
|
|---|
| Fonte | ⚠️ https://github.com/DAMO-NLP-SG/VideoLLaMA2/issues/182 |
|---|
| Utente | Dem00000 (UID 98563) |
|---|
| Sottomissione | 10/10/2026 10:38 (17 giorni fa) |
|---|
| Moderazione | 26/10/2026 17:12 (16 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 426516 [DAMO Academy VideoLLaMA2 fino a 1.1 Model Loading __init__.py load_pretrained_model _name_or_path] |
|---|
| Punti | 20 |
|---|