David Rochester

**Name of the Vulnerable Software and Affected Versions** Docker Model Runner on macOS (affected versions not specified) **Description** The vllm-metal inference backend unconditionally sets `trust remote code=True` when loading model tokenizers and operates without sandboxing. This allows the `transformers.AutoTokenizer.from pretrained()` function to import and execute arbitrary Python files contained within any model retrieved from an OCI registry. Consequently, this leads to arbitrary code execution on the Docker host with the privileges of the Docker Desktop user when inference is triggered. Any container on the Docker network can initiate this process by calling the 'model-runner.docker.internal' API to pull a malicious model and request inference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Docker Model Runner on macOS (affected versions not specified) **Description** The MLX inference backend uses the MLX-LM library, which imports and executes arbitrary Python files from model directories via the `model file` configuration field in the `config.json` file. This occurs because MLX-LM utilizes `importlib` to load and execute the file without a safety check or trust gate. Since the MLX backend operates without sandboxing, this leads to arbitrary code execution on the Docker host as the Docker Desktop user. An attacker can trigger this by calling the 'model-runner.docker.internal' API to pull a malicious model from a controlled OCI registry and requesting inference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** sgl-project SGLang versions prior to 0.6.0 **Description** A code injection issue exists in the HuggingFace Transformer Handler within the `get tokenizer()` function of the `python/sglang/srt/utils/hf transformers utils.py` file. When a caller sets the `trust remote code` variable to `False`, SGLang may silently re-invoke `AutoTokenizer.from pretrained` with `trust remote code` set to `True` if HuggingFace transformers v5 returns a TokenizersBackend instance. This overrides the security setting and allows a model repository containing a malicious `tokenizer.py` referenced via `auto map` in `tokenizer config.json` to execute arbitrary Python code in the SGLang process. This affects both `tokenizer mode="auto"` and `tokenizer mode="slow"`. The attack can be executed remotely, although it is characterized by high complexity and difficult exploitability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `get tokenizer()` function or avoid loading tokenizers from untrusted model repositories.