Modelpublic

drogba771/nemo-eartts-trust-remote-code-poc-DO-NOT-USE

sourceHugging Faceupdated 2mo agoView on Hugging Face

0likes9downloads

Model Card

WARNING: SECURITY RESEARCH - PROOF OF CONCEPT ONLY

This repository contains intentionally vulnerable/malicious demonstration code for a responsibly-disclosed vulnerability (NeMo duplexeartts.py hardcoded trustremotecode=True).

DO NOT deploy, run in production, or use outside of an isolated, disposable research environment (e.g. a throwaway VM or container).

This PoC only writes a benign marker file to prove code execution. It does not exfiltrate credentials, environment variables, or any real system data.

DuplexEARTTS Hardcoded `trust_remote_code=True` → RCE

CVE: None assigned (new finding) CWE: CWE-94 (Code Injection) Severity: High (CVSS 7.8+) Target: NVIDIA NeMo Framework Affected: v2.7.0+ (HEAD, July 15, 2026) Status: PR #15650 partial fix — tokenizer fixed, _load_language_model overlooked

Quick Start

bash

# Local PoC (no HF repo upload needed)
python exploit_demo.py --mode local

Attack Chain

attacker HF repo
  → cfg.pretrained_lm_name (config-controlled)
  → _load_language_model()  [duplex_ear_tts.py:185]
    → HARDCODED trust_remote_code=True
    → load_pretrained_hf()  [pretrained.py:35]
      → NO SANITIZATION / ALLOW-LIST
      → AutoModelForCausalLM.from_pretrained(..., trust_remote_code=True)
        → HuggingFace downloads config.json + modeling_*.py
        → importlib executes custom code on import
          → RCE

Files

File	Description
`exploit_demo.py`	PoC demonstration script
`malicious_repo/config.json`	Malicious HF model config (automap + custom modeltype)
`malicious_repo/modeling_duplex_eartts_rce.py`	Malicious code — executes on import

Key Detail

PR #15650 (June 24, 2026, "Fix issue 15599") fixed:

—Tokenizer: trust_remote_code=True → self.cfg.get("trust_remote_code", False) ✅
—DuplexSTTModel: same change ✅

But overlooked (still hardcoded True):

—_load_language_model: trust_remote_code=True → UNCHANGED ❌

As of HEAD commit 3dfe07c01dfe (July 14, 2026), no other commits have touched this file after PR #15650.