Vulnerability Report:trust_remote_code param is enabled, causing unsafe execution of Python files
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 39.5k
- Forks
- 4.8k
- PR merge metrics
- No merged PRs in 30d
Description
I think it's necessary to provide a security vulnerability report for the project
https://github.com/lm-sys/FastChat/blob/main/fastchat/model/model_adapter.py#L108
tokenizer = AutoTokenizer.from_pretrained( model_path, use_fast=self.use_fast_tokenizer, revision=revision, trust_remote_code=True, )
There is a security risk in using the AutoTokenizer.from_pretrained function if 'trust_remote_code' is equal to True. When there is a tokenizer_config.json file in the model's project directory and the "auto_map" field in this file contains an array parameter that starts with the character value "AutoTokenizer", the function will try to parse the following values of the array as Python files.
The attack effects are as follows
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with fastchat/model/model_adapter.py around line 108 and inspect the AutoTokenizer.from_pretrained call with trust_remote_code=True. Confirm the reported execution path using the tokenizer_config.json and linked example, then determine the required security change. Done means the unsafe path is prevented or explicitly guarded and the vulnerability has a reproducible check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100