A critical code injection vulnerability in the InternLM lmdeploy toolkit allows unauthenticated attackers to achieve remote code execution by tricking users into loading a malicious model.

This vulnerability occurs due to the use of the eval function on unvalidated input within the lmdeploy/pytorch/config.py file. An unauthenticated attacker can supply a crafted quantization_config.quant_dtype value in a HuggingFace model, which is then executed as arbitrary Python code when the model is loaded by the target system.

The ability to execute arbitrary code on a server hosting or processing large language models poses a catastrophic risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized access to sensitive training data, exfiltration of proprietary model weights, or the deployment of persistent backdoors within the AI infrastructure. With a CVSS score of 8.8, this vulnerability is classified as high severity and requires immediate attention to prevent operational disruption and data theft.

Immediate Action: Update the lmdeploy package to version 0.12.3 or higher immediately to incorporate the necessary validation logic.

Proactive Monitoring: Monitor system logs for unexpected execution of Python processes or unauthorized file modifications originating from the model loading service.

Compensating Controls: Implement strict sandboxing for the model loading environment and restrict outbound network access from services that process external model files to prevent potential command and control communication.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations utilizing InternLM lmdeploy must prioritize this update across all deployment environments. Verify that the patch to version 0.12.3 is applied across all production and development instances immediately, as the reliance on user-provided model files creates a significant and ongoing attack surface.