InternLM lmdeploy versions 0.12.1 through 0.12.2 have a code injection vulnerability in the file lmdeploy/pytorch/config.py at line 620. The vulnerability arises because the quantization_config.quant_dtype value from a HuggingFace model is passed directly to eval(f'torch.{quant_dtype}') without validation. An attacker can craft this value to execute arbitrary Python code when the model is loaded. This is classified as CWE-400 (Uncontrolled Resource Consumption) due to the potential for arbitrary code execution and resource abuse. The vulnerability is fixed in version 0.12.3.

Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code on the system loading the malicious model, potentially leading to full system compromise, data theft, or denial of service. The CVSS v3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Users should upgrade to InternLM lmdeploy version 0.12.3 or later, which contains the official patch for this vulnerability. Until upgrading, avoid loading untrusted or unauthenticated HuggingFace models with lmdeploy. No other mitigations are specified by the vendor.