Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the hardcoded use of trust_remote_code=True in several places within the lmdeploy library. This allows for remote code execution when a user loads a malicious model from Hugging Face. The advisory clearly points out the vulnerable functions and code snippets.
The following functions have been identified as vulnerable:
lmdeploy.archs.get_model_arch: This function, located in lmdeploy/archs.py, is called for every model loading process. It uses AutoConfig.from_pretrained with trust_remote_code=True hardcoded, making it a primary vector for this vulnerability.
lmdeploy.lite.apis.calibrate.calibrate: The calibrate function in lmdeploy/lite/apis/calibrate.py is used for model quantization. It calls both AutoTokenizer.from_pretrained and load_hf_from_pretrained with trust_remote_code=True, exposing users of the lmdeploy lite calibrate command to the vulnerability.
lmdeploy.lite.utils.load.load_hf_from_pretrained: This helper function in lmdeploy/lite/utils/load.py is used to load Hugging Face models. It internally calls AutoConfig.from_pretrained with trust_remote_code=True, meaning any part of lmdeploy that uses this function is vulnerable.
The root cause of the vulnerability is that lmdeploy overrides the safety default of trust_remote_code=False set by Hugging Face's transformers library. This default was put in place to prevent the exact kind of remote code execution that lmdeploy is vulnerable to. By hardcoding trust_remote_code=True, lmdeploy exposes its users to a significant security risk, as they may unknowingly execute malicious code from a model repository.
The fix for this vulnerability would be to make the trust_remote_code setting an opt-in feature, controlled by a command-line flag, and to default it to False. This would align lmdeploy with the security practices of other tools in the ecosystem and protect users from this supply-chain attack vector.
lmdeploy.archs.get_model_archlmdeploy/archs.py
lmdeploy.lite.apis.calibrate.calibratelmdeploy/lite/apis/calibrate.py
lmdeploy.lite.utils.load.load_hf_from_pretrainedlmdeploy/lite/utils/load.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lmdeploy | pip | <= 0.12.3 |