| Title | TinyLLaVA TinyLLaVA_Factory up to 1.0.0 Code Injection |
|---|
| Description | A vulnerability was found in TinyLLaVA_Factory up to 1.0.0 and classified as high 8.8.
Affected is the _load_text_config function of the TinyLlavaConfig component in the file
tinyllava/model/configuration_tinyllava.py. The manipulation of the argument
llm_model_name_or_path (taken from the outer config.json of a model repository) leads to
code injection: AutoConfig.from_pretrained is called with trust_remote_code=True hardcoded,
so an auto_map entry in an attacker-supplied nested config.json is imported and executed
during the configuration stage, before the loader fails on missing model weights. It is
possible to launch the attack remotely. User interaction is required because the victim
must load a crafted model repository (e.g. via tinyllava.serve.cli --model-path).
Technical Details
- Affected file/function: tinyllava/model/configuration_tinyllava.py / TinyLlavaConfig._load_text_config (line 101)
- Vulnerable parameter: llm_model_name_or_path in the outer config.json of the loaded repository
- Attack vector: Network
- Privileges required: None
- Trigger condition: victim loads a crafted model repository that contains no weight files;
the nested auto_map module executes at configuration-parse time. Code present since the
initial release commit 9e010c0 (2024-05-18) through main commit 1abc6ac (2026-09-08).
Impact
- Confidentiality: High (arbitrary code runs with the victim's privileges; data and tokens can be exfiltrated)
- Integrity: High (arbitrary file/system modification in the victim's user context)
- Availability: High (arbitrary code can destroy the environment)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-24
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Remove the hardcoded trust_remote_code=True and propagate an explicit, default-off
trust_remote_code flag from the caller; until patched, do not load model repositories
from untrusted sources. |
|---|
| Source | ⚠️ https://github.com/TinyLLaVA/TinyLLaVA_Factory/issues/212 |
|---|
| User | Dem0 (UID 82596) |
|---|
| Submission | 09/24/2026 17:25 (18 days ago) |
|---|
| Moderation | 10/11/2026 21:20 (17 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416776 [TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b TinyLlavaConfig configuration_tinyllava.py _load_text_config llm_model_name_or_path code injection] |
|---|
| Points | 20 |
|---|