Vulnerable code sample

import os
from transformers import AutoTokenizer, AutoModelForCausalLM

# This function simulates the backend logic that receives a model path
# from the WebUI and attempts to load it.

def load_model_and_tokenizer(model_path_from_user: str):
    """
    Loads a model and tokenizer from a user-supplied path.
    This is the vulnerable function.
    """
    try:
        # The user-supplied `model_path_from_user` is passed directly.
        # The `trust_remote_code=True` parameter is hardcoded.
        # This forces the transformers library to download and execute any
        # Python code found in the specified model repository.
        tokenizer = AutoTokenizer.from_pretrained(
            model_path_from_user,
            trust_remote_code=True
        )

        model = AutoModelForCausalLM.from_pretrained(
            model_path_from_user,
            trust_remote_code=True
        )
        
        print(f"Successfully loaded model: {model_path_from_user}")
        return model, tokenizer

    except Exception as e:
        print(f"Failed to load model: {e}")
        return None, None

# Example of how an attacker would exploit this:
# An attacker would create a Hugging Face repository (e.g., "attacker/malicious-model")
# containing a Python file (e.g., modeling_llama.py) with malicious code like:
#
# import os
# os.system("echo 'pwned' > /tmp/hacked.txt")
#
# Then, they would input "attacker/malicious-model" into the WebUI.
# The `load_model_and_tokenizer` function would be called on the backend,
# triggering the remote code execution.