ResponsibleReport/llama-cpp-torchload-poc

llama.cpp torch.load() RCE PoC

Vulnerability

Multiple conversion scripts in llama.cpp use torch.load() without weights_only=True, allowing arbitrary code execution.

Affected Files

• tools/mtmd/legacy-models/glmedge-convert-image-encoder-to-gguf.py
• tools/mtmd/legacy-models/minicpmv-convert-image-encoder-to-gguf.py
• tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py

PoC

malicious_projector.pt contains a pickle payload that executes touch /tmp/llama_cpp_rce_poc when loaded.

Reproduction

git clone https://github.com/ggml-org/llama.cpp
cd llama.cpp

python tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py \
    --llava-projector path/to/malicious_projector.pt \
    --model-dir /tmp

ls /tmp/llama_cpp_rce_poc  # File created = RCE

Impact

RCE when users convert untrusted PyTorch models to GGUF format.

Fix

projector = torch.load(args.llava_projector, weights_only=True)