drogba771/nemo-eartts-trust-remote-code-poc-DO-NOT-USE

WARNING: SECURITY RESEARCH - PROOF OF CONCEPT ONLY

This repository contains intentionally vulnerable/malicious demonstration code for a responsibly-disclosed vulnerability (NeMo duplex_ear_tts.py hardcoded trust_remote_code=True).

DO NOT deploy, run in production, or use outside of an isolated, disposable research environment (e.g. a throwaway VM or container).

This PoC only writes a benign marker file to prove code execution. It does not exfiltrate credentials, environment variables, or any real system data.

---

DuplexEARTTS Hardcoded trust_remote_code=True → RCE

CVE: None assigned (new finding) CWE: CWE-94 (Code Injection) Severity: High (CVSS 7.8+) Target: NVIDIA NeMo Framework Affected: v2.7.0+ (HEAD, July 15, 2026) Status: PR #15650 partial fix — tokenizer fixed, _load_language_model overlooked

Quick Start

# Local PoC (no HF repo upload needed)
python exploit_demo.py --mode local

Attack Chain

attacker HF repo
  → cfg.pretrained_lm_name (config-controlled)
  → _load_language_model()  [duplex_ear_tts.py:185]
    → HARDCODED trust_remote_code=True
    → load_pretrained_hf()  [pretrained.py:35]
      → NO SANITIZATION / ALLOW-LIST
      → AutoModelForCausalLM.from_pretrained(..., trust_remote_code=True)
        → HuggingFace downloads config.json + modeling_*.py
        → importlib executes custom code on import
          → RCE

Files

File	Description
exploit_demo.py	PoC demonstration script
malicious_repo/config.json	Malicious HF model config (auto_map + custom model_type)
malicious_repo/modeling_duplex_eartts_rce.py	Malicious code — executes on import

Key Detail

PR #15650 (June 24, 2026, "Fix issue 15599") fixed:

• Tokenizer: trust_remote_code=True → self.cfg.get("trust_remote_code", False) ✅
• DuplexSTTModel: same change ✅

But overlooked (still hardcoded True):

• _load_language_model: trust_remote_code=True → UNCHANGED ❌

As of HEAD commit 3dfe07c01dfe (July 14, 2026), no other commits have touched this file after PR #15650.