CVE-2026-33625

Arbitrary code exec via eval of unvalidated quant_dtype in lmdeploy config

• CVSS 8.8
• 400
• Input Validation and Sanitization
• Remote

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.

CVE

CVE-2026-33625

CWE

400

CVSS base score

8.8

Published

2026-09-18

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

lmdeploy

Fixed by upgrading

Yes

Solution

Upgrade LMDeploy to version 0.12.3 or later.

import torch

def get_quant_dtype(config):
    # Extract quant_dtype from config
    quant_cfg = config.get('quantization_config', {})
    quant_dtype = quant_cfg.get('quant_dtype', 'float32')
    # VULNERABLE: unsafe eval of user-controlled string
    dtype = eval(f'torch.{quant_dtype}')
    return dtype

def load_model(model_path, config):
    dtype = get_quant_dtype(config)
    # Placeholder for actual model loading logic
    model = torch.nn.Module()
    model.dtype = dtype
    return model

import torch

ALLOWED_DTYPES = {'float32', 'float16', 'bfloat16'}

def get_quant_dtype(config):
    # Extract quant_dtype from config
    quant_cfg = config.get('quantization_config', {})
    quant_dtype = quant_cfg.get('quant_dtype', 'float32')
    # FIX: whitelist validation instead of eval
    if quant_dtype not in ALLOWED_DTYPES:
        raise ValueError(f'Unsupported quant_dtype: {quant_dtype}')
    dtype = getattr(torch, quant_dtype)
    return dtype

def load_model(model_path, config):
    dtype = get_quant_dtype(config)
    # Placeholder for actual model loading logic
    model = torch.nn.Module()
    model.dtype = dtype
    return model

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202633625,
  title        = {{Arbitrary code exec via eval of unvalidated quant_dtype in lmdeploy config}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-33625},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-33625/}}
}