| # llama.cpp torch.load() RCE PoC | |
| ## Vulnerability | |
| Multiple conversion scripts in llama.cpp use `torch.load()` without `weights_only=True`, allowing arbitrary code execution. | |
| ## Affected Files | |
| - `tools/mtmd/legacy-models/glmedge-convert-image-encoder-to-gguf.py` | |
| - `tools/mtmd/legacy-models/minicpmv-convert-image-encoder-to-gguf.py` | |
| - `tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py` | |
| ## PoC | |
| `malicious_projector.pt` contains a pickle payload that executes `touch /tmp/llama_cpp_rce_poc` when loaded. | |
| ## Reproduction | |
| ```bash | |
| git clone https://github.com/ggml-org/llama.cpp | |
| cd llama.cpp | |
| python tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py \ | |
| --llava-projector path/to/malicious_projector.pt \ | |
| --model-dir /tmp | |
| ls /tmp/llama_cpp_rce_poc # File created = RCE | |
| ``` | |
| ## Impact | |
| RCE when users convert untrusted PyTorch models to GGUF format. | |
| ## Fix | |
| ```python | |
| projector = torch.load(args.llava_projector, weights_only=True) | |
| ``` | |