T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/asr.py:38
- Finding
- Unpinned Remote Model Code Is Trusted and Executed## Vulnerability Details **File Location**: `scripts/asr.py`, lines 38–42 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```python model = AutoModel( model='iic/SenseVoiceSmall', trust_remote_code=True, device='cuda:0', ) ``` ### Technical Analysis The default FunASR execution path loads the `iic/SenseVoiceSmall` model with `trust_remote_code=True`. This setting authorizes executable Python code supplied by the remote model repository to run in the local process. The model reference is not pinned to an immutable revision, commit identifier, or verified artifact hash. Consequently, the code executed during a future model load can differ from the code available when this Skill was reviewed. This creates a remote code execution supply-chain boundary rather than merely downloading passive model weights. The behavior is especially significant because FunASR is the default engine. A normal invocation of the Skill can therefore reach this code without the user explicitly opting into remote code execution. ### Attack Path 1. An attacker compromises the upstream model repository, its publisher account, or another relevant artifact-delivery component. 2. The attacker modifies the repository's custom model-loading implementation or another remotely loaded executable file. 3. A user invokes the Skill with the default FunASR engine. 4. `AutoModel` retrieves the current contents associated with `iic/SenseVoiceSmall`. 5. Because `trust_remote_code=True` is enabled, the attacker's code executes inside the ASR process. 6. The code can act with the same operating-system identity and environmental access as that process. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the user running the Skill. Depending on the surrounding runtime configuration, malicious remote code could read or alter accessible fi ...[truncated 456 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `trust_remote_code=True` and use a model implementation provided by a locally installed, reviewed library whenever possible. 2. If custom model code is unavoidable, pin the model to an audited immutable revision rather than a mutable repository name. 3. Verify downloaded model and code artifacts using approved cryptographic hashes or signatures before loading them. 4. Consider vendoring the reviewed model implementation into the project so that executable code is covered by normal source review and release controls. 5. Run model loading and inference in a dedicated sandbox or container with: - No unnecessary credentials or secrets. - Read-only access to input files. - A dedicated writable cache and output directory. - Restricted outbound network access. - Minimal operating-system privileges. 6. Separate artifact download from execution: fetch and verify artifacts during a controlled installation phase, then perform inference with network access disabled. 7. Document explicitly that loading remote custom code is required if this behavior cannot be removed.