T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:128- Finding
Unverified Model Archive Can Execute Remote Repository Code
- Content
View full analysis
/dev/null && command -v unzip &> /dev/null; then curl -L -o genos-1.2b.zip "https://github.com/zhejianglab/Genos/releases/download/v1.0/Genos-1___2B.zip" unzip -o genos-1.2b.zip -d ./models/Genos-1___2B rm -f genos-1.2b.zip echo "✓ 模型已从 GitHub Releases 下载" ``` `scripts/genos_dna.py:78-89`: ```python def load_model(): """加载 Genos 模型""" global _model, _tokenizer if _model is None: print("Loading Genos model...", file=sys.stderr) _tokenizer = AutoTokenizer.from_pretrained(model_path, trust_remote_code=True, local_files_only=True) _model = AutoModelForCausalLM.from_pretrained( model_path, torch_dtype=torch.float16, device_map="cpu", trust_remote_code=True, local_files_only=True ) ``` ### Technical Analysis The optional installer follows HTTP redirects, downloads a mutable release archive, and extracts it without validating a cryptographic checksum, signature, immutable revision, expected file list, or final download origin. The runtime subsequently loads that model with `trust_remote_code=True`. This Transformers option permits custom Python modules contained in the model repository to execute in the current Python process. Although `local_files_only=True` prevents model retrieval during the loading operation, it does not establish the integrity or safety of files previously downloaded by the installer. This creates a direct trust chain from an externally controlled release asset to local Python code execution. The GitHub URL appears consistent with the declared Genos organization, so the presence of the download is not by itself evidence of malicious ...[truncated 1959 chars]- Remediation
View remediation