Submeter #997719: bytetriper RAE up to main commit a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041 (last commit 2026-01-20) Code Injection

A vulnerability was found in RAE up to main commit a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041 and classified as high 7.8. Affected is the config-driven model instantiation component (src/utils/model_utils.py instantiate_from_config). The manipulation of the config YAML target/params fields leads to code injection. The attack is launched locally: the victim has to run one of the documented training or sampling scripts pointed at an attacker-supplied config YAML.

Technical Details
- Affected file/function (verified at the current default branch a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041, re-read 2026-09-24):
src/utils/model_utils.py:9-14 (get_obj_from_str) resolves an arbitrary dotted string via importlib.import_module and getattr, importing any module and returning any object; src/utils/model_utils.py:19 calls that object with the YAML-controlled params dict as keyword arguments; src/utils/model_utils.py:22 additionally torch.load()s a config-pointed checkpoint file. Nine documented entrypoints accept a --config path and reach the same sink: src/sample.py:31-33, src/train.py:108,217,219, src/stage1_sample.py:83, src/stage1_sample_ddp.py:97, src/sample_ddp.py:141-142, src/calculate_stat.py:212, src/extract_decoder.py:121. No allowlist or validation of target exists anywhere on the path.
- Vulnerable parameter: the target (and params/ckpt) fields of the OmegaConf config YAML passed via --config, e.g. stage_1.target, stage_2.target, guidance.guidance_model.target
- Attack vector: Local
- Privileges required: None
- Trigger condition: running any pipeline entrypoint with a config YAML from a non-repository source. The repository's own documented workflows read configs from its own configs/ directory and the released model artifacts are weights-only, so the exposure materializes when a config authored by a third party is used - the common shared-fine-tune-config pattern. No validation, allowlist or trust decision is presented to the user on any entrypoint.
- Origin of the weakness: the pattern is the long-standing latent-diffusion-lineage instantiate_from_config reflection; this repository applies it unrestricted across all nine entrypoints. Source-level review only (static analysis at the pinned commit; line numbers re-verified at current HEAD 2026-09-24); no exploit was executed.

Impact
- Confidentiality: High (arbitrary module import and callable invocation with attacker-chosen arguments runs with the loading process's privileges)
- Integrity: High (the same reach applies to writes)
- Availability: High (the invoked code can terminate or hang the process)

CVSS v3.1
Score: 7.8 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-09-20
- Vendor notified: 2026-09-24 (issue <NUM> opened; mechanism and hardening request only, no exploit attached)
- Patch released: [pending]
- Public disclosure: 2026-09-24 (issue <NUM> published; exploit not released)

Countermeasure
Validate the target field against an allowlist or registry of known classes (or at minimum a first-party module-prefix check) and fail closed; alternatively gate arbitrary targets behind an explicit opt-in flag with a warning. Document that config YAMLs are executable content. Prefer torch.load(..., weights_only=True) for the config-pointed checkpoint path.

• Fonte: ⚠️ https://github.com/bytetriper/RAE/issues/82
• Utilizador: dem0000 (UID 98390)
• Submissão: 24/09/2026 15h51 (há 30 dias)
• Moderação: 11/10/2026 20h48 (17 days later)
• Estado: Aceite
• Entrada VulDB: 416769 [repository RAE até a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041 Config-Driven Model Instantiation src/utils/model_utils.py get_obj_from_str target Elevação de Privilégios]
• Pontos: 20