iframe-proxy

Vancir · 2026-07-20T01:59:57Z

Security: fix multiple RCE vectors in ModelScope

This PR fixes a cluster of remote-code-execution bugs where attacker-controlled
artifacts (model repo files) were fed unchecked to create_model, load_model_from_config,
or unsafe YAML loaders.

Issue Remote code execution via unsafe yaml loading #1660 — RCE via unsafe yaml loading

use yaml.SafeLoader rather than unsafe yaml.Loader

Issue Remote code execution via ImageViewTransform during model loading #1659 — RCE via ImageViewTransform

add check_trust_remote_code() before load_model_from_config.

Issue Remote Code Execution via unsafe YAML-based dynamic instantiation in ControlNet and StablediffusionPaintbyexample #1758 - RCE via ControlNet and StablediffusionPaintbyexample

add check_trust_remote_code() before load_model_from_config.
add check_trust_remote_code() before create_model.

gemini-code-assist

Code Review

This pull request improves security by switching from unsafe YAML loading to yaml.SafeLoader and adding or reordering check_trust_remote_code checks before loading configurations. The review feedback recommends using the more idiomatic and concise yaml.safe_load function instead of explicitly passing Loader=yaml.SafeLoader. Additionally, it is advised to call check_trust_remote_code at the very beginning of initialization methods to ensure no untrusted files are parsed beforehand.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-07-20T02:01:47Z

        device = kwargs.get('device', 'cuda')
        if device == 'gpu':
            device = 'cuda'
+        self.check_trust_remote_code(model_dir=model_dir)


Calling self.check_trust_remote_code(model_dir=model_dir) at the very beginning of __init__ (right after super().__init__) is safer and more robust. This ensures that any configuration loading (such as Config.from_file on line 42) or parameter parsing from the untrusted model directory is gated by the trust check, preventing potential exploitation of parser vulnerabilities or unnecessary processing of untrusted input.

gemini-code-assist · 2026-07-20T02:01:48Z

        config = OmegaConf.load(os.path.join(model_dir, 'v1.yaml'))
+        self.check_trust_remote_code(model_dir=model_dir)


Calling self.check_trust_remote_code(model_dir=model_dir) before loading the configuration file (v1.yaml) via OmegaConf.load is safer. This ensures that no files from the untrusted model directory are parsed or loaded before verifying that the remote code/repository is trusted.

Suggested change

config = OmegaConf.load(os.path.join(model_dir, 'v1.yaml'))

self.check_trust_remote_code(model_dir=model_dir)

self.check_trust_remote_code(model_dir=model_dir)

config = OmegaConf.load(os.path.join(model_dir, 'v1.yaml'))

gemini-code-assist · 2026-07-20T02:01:48Z

+            self.am_config = yaml.load(f, Loader=yaml.SafeLoader)
        with open(self.voc_config_path, 'r') as f:
-            self.voc_config = yaml.load(f, Loader=yaml.Loader)
+            self.voc_config = yaml.load(f, Loader=yaml.SafeLoader)


Using yaml.safe_load(f) is more idiomatic, cleaner, and less verbose than yaml.load(f, Loader=yaml.SafeLoader) while providing the same security guarantees.

Suggested change

self.am_config = yaml.load(f, Loader=yaml.SafeLoader)

with open(self.voc_config_path, 'r') as f:

self.voc_config = yaml.load(f, Loader=yaml.Loader)

self.voc_config = yaml.load(f, Loader=yaml.SafeLoader)

self.am_config = yaml.safe_load(f)

with open(self.voc_config_path, 'r') as f:

self.voc_config = yaml.safe_load(f)

gemini-code-assist · 2026-07-20T02:01:48Z

+            config = yaml.load(f, Loader=yaml.SafeLoader)
        with open(config_path, 'r') as f:
-            config.update(yaml.load(f, Loader=yaml.Loader))
+            config.update(yaml.load(f, Loader=yaml.SafeLoader))


Using yaml.safe_load(f) is more idiomatic, cleaner, and less verbose than yaml.load(f, Loader=yaml.SafeLoader) while providing the same security guarantees.

Suggested change

config = yaml.load(f, Loader=yaml.SafeLoader)

with open(config_path, 'r') as f:

config.update(yaml.load(f, Loader=yaml.Loader))

config.update(yaml.load(f, Loader=yaml.SafeLoader))

config = yaml.safe_load(f)

with open(config_path, 'r') as f:

config.update(yaml.safe_load(f))

gemini-code-assist · 2026-07-20T02:01:48Z

+            config = yaml.load(f, Loader=yaml.SafeLoader)

        with open(config_path, 'r') as f:
-            config.update(yaml.load(f, Loader=yaml.Loader))
+            config.update(yaml.load(f, Loader=yaml.SafeLoader))


Using yaml.safe_load(f) is more idiomatic, cleaner, and less verbose than yaml.load(f, Loader=yaml.SafeLoader) while providing the same security guarantees.

Suggested change

config = yaml.load(f, Loader=yaml.SafeLoader)

with open(config_path, 'r') as f:

config.update(yaml.load(f, Loader=yaml.Loader))

config.update(yaml.load(f, Loader=yaml.SafeLoader))

config = yaml.safe_load(f)

with open(config_path, 'r') as f:

config.update(yaml.safe_load(f))

gemini-code-assist · 2026-07-20T02:01:48Z

                                             os.PathLike]) -> Dict[str, Any]:
        with open(yaml_file, 'r', encoding='utf-8') as reader:
-            config_dict = yaml.load(reader, Loader=yaml.Loader)
+            config_dict = yaml.load(reader, Loader=yaml.SafeLoader)


Using yaml.safe_load(reader) is more idiomatic, cleaner, and less verbose than yaml.load(reader, Loader=yaml.SafeLoader) while providing the same security guarantees.

Suggested change

config_dict = yaml.load(reader, Loader=yaml.SafeLoader)

config_dict = yaml.safe_load(reader)

gemini-code-assist · 2026-07-20T02:01:48Z

                                             os.PathLike]) -> Dict[str, Any]:
        with open(yaml_file, 'r', encoding='utf-8') as reader:
-            config_dict = yaml.load(reader, Loader=yaml.Loader)
+            config_dict = yaml.load(reader, Loader=yaml.SafeLoader)


Using yaml.safe_load(reader) is more idiomatic, cleaner, and less verbose than yaml.load(reader, Loader=yaml.SafeLoader) while providing the same security guarantees.

Suggested change

config_dict = yaml.load(reader, Loader=yaml.SafeLoader)

config_dict = yaml.safe_load(reader)

mtholmquist · 2026-08-28T23:18:02Z

Thanks for tackling these — switching the yaml.Loader calls in voice.py and configuration_mplug.py to SafeLoader is the correct fix.

For the record and to help with tracking: I independently reported these same sinks (the sambert TTS Voice.__init__ acoustic/vocoder config loads and the MPlug config loads) through GitHub's private vulnerability reporting on 2026-07-07 — advisory GHSA-7629-4rmx-r5c4 — about two weeks before this PR was opened. They remain exploitable on the latest release (1.39.1) and the v1.40.0 tag: a model config YAML carrying a !!python/object/apply:... tag runs arbitrary code on load, since yaml.Loader honors those tags with no trust_remote_code gate.

Could a maintainer link this PR to GHSA-7629-4rmx-r5c4 and publish the advisory (with a CVE) when it merges? I'm glad to help with the advisory metadata — the affected range should read <= 1.39.1, not the draft's <= 1.38.1. Thanks again.

Vancir · 2026-08-28T23:28:34Z

I reported the unsafe YAML deserialization about 10 months ago (#1538, #1540). It takes the maintainers long time to handle these issues, so I had to create a PR to shorten the fix cycle.

github-actions · 2026-10-13T02:04:16Z

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

Vancir · 2026-10-13T02:07:29Z

Fix several security issues.

62e171f

gemini-code-assist Bot reviewed Jul 20, 2026

View reviewed changes

Vancir mentioned this pull request Jul 20, 2026

Remote Code Execution via unsafe YAML-based dynamic instantiation in ControlNet and StablediffusionPaintbyexample #1758

Closed

github-actions Bot added the Stale label Oct 13, 2026

github-actions Bot removed the Stale label Oct 14, 2026

		config = OmegaConf.load(os.path.join(model_dir, 'v1.yaml'))
		self.check_trust_remote_code(model_dir=model_dir)

	config_dict = yaml.load(reader, Loader=yaml.SafeLoader)
	config_dict = yaml.safe_load(reader)

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

Vancir commented Jul 20, 2026

Security: fix multiple RCE vectors in ModelScope

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

mtholmquist commented Aug 28, 2026

Uh oh!

Vancir commented Aug 28, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

Vancir commented Oct 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants