T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/main.py:281- Finding
Remote Model Repository Code Is Trusted and Executed by Default
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py:67,scripts/main.py:281-306, andscripts/main.py:345-362
Vulnerability Type: Remote code execution through untrusted model repository content
Risk Level: HighVulnerable Code
python @dataclass class MedicalTrainingConfig: # Model config model_name_or_path: str = "meta-llama/Llama-2-7b-hf" tokenizer_name: Optional[str] = None trust_remote_code: bool = Truepython def __init__( self, model_name: str = "meta-llama/Llama-2-7b-hf", task: str = "medical_qa", lora_r: int = 64, lora_alpha: int = 128, use_qlora: bool = False, target_modules: Optional[List[str]] = None, device_map: str = "auto", trust_remote_code: bool = True, config: Optional[MedicalTrainingConfig] = None ): self.config = config or MedicalTrainingConfig() # Override config with direct parameters self.config.model_name_or_path = model_name self.config.lora_r = lora_r self.config.lora_alpha = lora_alpha self.config.use_qlora = use_qlora self.config.load_in_4bit = use_qlora self.config.trust_remote_code = trust_remote_codepython # Load tokenizer tokenizer_name = self.config.tokenizer_name or self.config.model_name_or_path self.tokenizer = AutoTokenizer.from_pretrained( tokenizer_name, trust_remote_code=self.config.trust_remote_code, padding_side="right", ) # Set pad token if not exists if self.tokenizer.pad_token is None: self.tokenizer.pad_token = self.tokenizer.eos_token self.tokenizer.pad_token_id = self.tokenizer.eos_token_id # Load model self.model = AutoModelForCausalLM.from_pretrained( self.config.model_name_or_path, quantization_config=quantization_config, device_map=self.config.device_map if quantization_config else None, trust_remote_code=self.config.trust_remote_code, ...[truncated 2463 chars]- Remediation
View remediation
Remediation Suggestions
- Change every default for
trust_remote_codetoFalse. - Do not overwrite an explicitly supplied configuration value with a constructor default. Use an optional override and only assign it when the caller explicitly provides one.
- Require an explicit, prominently documented opt-in before executing repository-provided code.
- Restrict remotely loaded models and tokenizers to an administrator-maintained allowlist.
- Pass an immutable, reviewed commit hash through the
revisionparameter for every remote model and tokenizer. - Prefer standard Transformers architectures that do not require custom repository code.
- Perform model loading and training in a sandbox with no unnecessary credentials, restricted filesystem mounts, limited outbound network access, and a nonprivileged operating-system account.
- Log the repository identifier and exact revision before loading it, and verify downloaded artifacts against approved hashes.
- Change every default for