AI Model-Loader `trust_remote_code` Order-of-Operations RCE Simulation (CVE-2026-22807)

Metadata

Affected Target

Summary

This repository is a small, self-contained Python testbed (vulnerable_lib.py) that reproduces a class of AI supply-chain vulnerability found in model-loading frameworks: when a loader resolves a model’s Python class via a config.json’s auto_map field, it can end up importing (and therefore executing) attacker-controlled code before it ever checks whether trust_remote_code was set to False. The companion script (poc.py) builds a malicious “model” directory containing a config.json that points AutoModel at a malicious.py module, whose top-level code runs an arbitrary OS command supplied on the command line. Loading that model with trust_remote_code=False still results in the command executing, and only afterward does the loader raise its “remote code not allowed” exception — proving the security check happens too late to matter.

Vulnerability Details

Root Cause

MiniLLM.__init__() (in vulnerable_lib.py) calls _resolve_model_class() — which dynamically imports a Python file named in the model’s config.json auto_map — before checking self.trust_remote_code. Since Python executes top-level module code at import time, any code in the referenced file runs regardless of the later trust_remote_code check.

Attack Vector

1. Attacker crafts a “model” directory with a config.json declaring "auto_map": {"AutoModel": "malicious.EvilModel"}.
2. Attacker plants a malicious.py in that directory whose top-level code calls os.system(<attacker command>).
3. Victim application loads the model directory via the vulnerable loader with trust_remote_code=False, intending to reject untrusted code.
4. The loader imports malicious.py to resolve the AutoModel class before the trust check runs, executing the attacker’s command; only after execution does the loader raise RuntimeError("Aborted: Remote code not allowed!").

Impact

Arbitrary OS command execution on any system that loads an untrusted/third-party model directory through a loader with this ordering bug, even when the caller explicitly disables remote code execution.

Environment / Lab Setup

Target:   Python 3.x, no third-party libraries needed (pure-stdlib simulation of the vulnerable loader)
Attacker: Same Python 3 interpreter, running poc.py locally

Proof of Concept

PoC Script

See poc.py and vulnerable_lib.py in this folder.

1
2

python3 poc.py whoami
python3 poc.py cat /etc/passwd

Running poc.py generates a dynamic_evil_model/ directory containing a rigged config.json and a malicious.py whose body runs the command passed on the command line (defaults to whoami). It then loads that directory via MiniLLM(model_path=..., trust_remote_code=False); the console shows the injected command’s output printed before the loader’s RuntimeError is raised, confirming the bypass.

Detection & Indicators of Compromise

Signs of compromise:

• OS commands or subprocesses observed originating from a model-loading/inference process, before any inference actually ran
• Untrusted model directories containing extra .py files referenced from config.json’s auto_map
• Loader logs showing a “remote code not allowed” rejection immediately after unexpected process activity (a sign the check ran too late)

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/otakuliu/CVE-2026-22807_Range on 2026-07-05.