Skip to content

fix: address supply-chain RCE via trust_remote_code and torch.load#241

Merged
QianhuiWu merged 2 commits intohot_bug_fixfrom
copilot/hot-bug-fix
Apr 8, 2026
Merged

fix: address supply-chain RCE via trust_remote_code and torch.load#241
QianhuiWu merged 2 commits intohot_bug_fixfrom
copilot/hot-bug-fix

Conversation

Copy link
Copy Markdown

Copilot AI commented Apr 7, 2026

  • Fix trust_remote_code defaulting to True in load_model() - change default to False
  • Fix trust_remote_code=True hardcoded in get_distance_jinza() - change to False
  • Fix unsafe torch.load() without weights_only=True in experiment scripts
  • Add Security Considerations section to DOCUMENT.md explaining trust_remote_code default change and how to opt-in
  • Update model_config parameter docs in DOCUMENT.md to mention trust_remote_code
  • Add a brief note in README.md Quick Start about the trust_remote_code breaking change
  • Run validation

- Change trust_remote_code default from True to False in load_model()
- Change trust_remote_code from True to False for jina model in get_distance_jinza()
- Add weights_only=True to torch.load() calls in experiments/llmlingua2/

Agent-Logs-Url: https://github.com/microsoft/LLMLingua/sessions/765d55a4-b2e4-4a32-bc6f-5321918d9c33

Co-authored-by: mydmdm <7117512+mydmdm@users.noreply.github.com>
@mydmdm mydmdm marked this pull request as ready for review April 8, 2026 05:26
@QianhuiWu QianhuiWu merged commit 88bcf03 into hot_bug_fix Apr 8, 2026
1 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants