Remote Code Execution in myshell-ai AIlice

Executive Summary

This vulnerability exists in myshell-ai AIlice up to version 0.4.0. It involves the LoadModel_PEFT function in the HuggingFace Model Wrapper, which loads a PEFT adapter's base model without validating the base_model_name_or_path field. An attacker can specify a malicious remote Hugging Face Hub repository, causing AIlice to download and execute the attacker's model before applying the adapter's inert LoRA deltas. The attack occurs because the base model is fetched unconditionally from the Hugging Face Hub without any allowlist checks or user confirmation.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized model downloads or executions by monitoring network traffic to Hugging Face Hub endpoints. Inspect adapter_config.json files in AIlice installations for suspicious base_model_name_or_path values pointing to untrusted repositories. Review locally cached models in AIlice's cache directory for unexpected files or modifications.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to control the model used by AIlice for generating responses. The attacker's model can manipulate downstream tool execution, such as shell commands, browser actions, or storage operations. The malicious model is also cached locally, persisting the threat across sessions. This results in complete loss of output integrity, as the attacker controls both the model weights and tokenizer generating responses.

Useful 0 Not Useful 0

Mitigation Strategies

Disable PEFT adapter loading until a patch is released. Block outbound connections to untrusted Hugging Face Hub repositories. Validate all adapter configurations manually before use. Monitor system logs for unexpected model downloads or executions.

Useful 0 Not Useful 0