Invia #997679: ModelTC LightX2V up to main commit 8652c6f1c7f12f226c43abbb91d4d4e9290932c2 (release 0.5.0, published 2026-09-10) Code Injection (CWE-94)

A vulnerability was found in LightX2V up to main commit 8652c6f1c7f12f226c43abbb91d4d4e9290932c2 (release 0.5.0) and classified as high 7.8. Affected is the Cosmos3 tokenizer loading component. The manipulation of the model bundle tokenizer sidecar content leads to code injection. The attack is launched locally: the victim has to run the documented pipeline against an attacker-supplied model bundle.

Technical Details
- Affected file/function (verified at the current default branch 8652c6f1c7f12f226c43abbb91d4d4e9290932c2 on 2026-09-24):
lightx2v/models/runners/cosmos3/cosmos3_runner.py:199 passes trust_remote_code=True to AutoTokenizer.from_pretrained() on a tokenizer directory taken from the user-supplied model bundle. A bundle-provided tokenizer_config.json:auto_map consequently imports and executes bundle-provided Python during the normal input-encoding phase. The public pipeline, CLI, and server configuration surfaces expose no trust_remote_code parameter, so callers cannot override the hard-coded value.
lightx2v/utils/set_config.py:89-94 provides a second entry into the same sink: for model_cls="ltx2_5", the transformer configuration embedded in the safetensors __metadata__ header is parsed and merged wholesale into the startup configuration (only rope_type is popped). There is no typed allowlist and no protection for operational keys, so a metadata value config.transformer.model_cls="cosmos3" replaces the caller-selected runner and routes into the hard-coded-trust loader. The demonstrated code execution of this variant still depends on the same sink; it is counted as an entry variant, not a second RCE root.
- Vulnerable parameter: the auto_map field of tokenizer_config.json inside a shared model bundle (primary), and the config.transformer.model_cls field of LTX-2.5 safetensors __metadata__ (entry variant)
- Attack vector: Local
- Privileges required: None
- Trigger condition: default configuration. The tokenizer import fires during a normal generate() call on the attacker-controlled bundle; the safetensors variant additionally needs no caller deviation — a caller who explicitly selects ltx2_5 is redirected by metadata alone.
- Origin of the weakness: the hard-coded trust entered via PR #1183 (2026-06-25) and the metadata merge via PR #1378 (2026-08-17); both behaviors are present in release 0.5.0 (2026-09-10) and at the current default branch.
- Validation: the import of bundle-provided Python was reproduced end to end through the real public pipeline API (LightX2VPipeline.create_generator()/generate()) with the real Transformers dynamic-module loader and a real fast tokenizer (Python 3.12, PyTorch 2.11, Transformers 5.5). The bundle-side module was payload-free (in-memory import marker); a safe boundary raised before heavyweight model construction. Controls: the same call with trust_remote_code=False rejected the module before import; the built-in tokenizer produced no import marker; process/shell/outbound-socket guards recorded zero events. An independently written second validator reproduced the same root, both entry paths, and the same negative controls.

Impact
- Confidentiality: High (arbitrary Python from the bundle executes with the loading process's privileges)
- Integrity: High (arbitrary code execution in the loading process)
- Availability: High (the process can be terminated or blocked at will)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-17
- Vendor notified: 2026-09-24 (issue 1559 opened; mechanism only, payload-free marker module, no exploit bundle attached)
- Patch released: [pending]
- Public disclosure: 2026-09-24 (issue 1559 published; exploit not released)

Countermeasure
Add trust_remote_code to every public API/CLI/server configuration surface, default it to False, and pass it through to the tokenizer loader; never derive it from model files. Prefer integrating the required Cosmos tokenizer into reviewed package code. Parse LTX-2.5 safetensors metadata against a typed allowlist and reject runner-selection fields (model_cls), task/component paths, trust flags, and load-sequencing keys; preserve the caller-selected runner identity after reading metadata. Until a fix is released, only run model bundles from trusted sources.

• Fonte: ⚠️ https://github.com/ModelTC/LightX2V/issues/1559
• Utente: dem0000 (UID 98390)
• Sottomissione: 24/09/2026 14:40 (29 giorni fa)
• Moderazione: 11/10/2026 20:45 (17 days later)
• Stato: Accettato
• Voce VulDB: 416768 [ModelTC LightX2V fino a 0.5.0 Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained auto_map escalationi di privilegi]
• Punti: 20