# llama.cpp torch.load() RCE PoC

## Vulnerability
Multiple conversion scripts in llama.cpp use `torch.load()` without `weights_only=True`, allowing arbitrary code execution.

## Affected Files
- `tools/mtmd/legacy-models/glmedge-convert-image-encoder-to-gguf.py`
- `tools/mtmd/legacy-models/minicpmv-convert-image-encoder-to-gguf.py`
- `tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py`

## PoC
`malicious_projector.pt` contains a pickle payload that executes `touch /tmp/llama_cpp_rce_poc` when loaded.

## Reproduction
```bash
git clone https://github.com/ggml-org/llama.cpp
cd llama.cpp

python tools/mtmd/legacy-models/convert_image_encoder_to_gguf.py \
    --llava-projector path/to/malicious_projector.pt \
    --model-dir /tmp

ls /tmp/llama_cpp_rce_poc  # File created = RCE
```

## Impact
RCE when users convert untrusted PyTorch models to GGUF format.

## Fix
```python
projector = torch.load(args.llava_projector, weights_only=True)
```