Mitigate CVE-2026-4372 transformers kernels RCE exposure#1746
Mitigate CVE-2026-4372 transformers kernels RCE exposure#1746kevalmorabia97 wants to merge 1 commit into
kernels RCE exposure#1746Conversation
transformers<5.3 combined with the optional `kernels` package allows remote code execution when loading untrusted models via the Hub kernel-download path (fixed in transformers 5.3.0). ModelOpt's core install never pulls in `kernels`, so: - Pin transformers>=5.3 in examples/gpt-oss (the only example that installs `kernels`). - Add a runtime warning in modelopt.torch, gated on `kernels` actually being importable, for affected transformers<5.3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Keval Morabia <28916987+kevalmorabia97@users.noreply.github.com>
📝 WalkthroughWalkthroughTwo files are updated to address CVE-2026-4372. The example ChangesCVE-2026-4372 Mitigation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 6✅ Passed checks (6 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
kevalmorabia97
added
the
cherry-pick-0.45.0
|
/claude review |
cjluo-nv
left a comment
cjluo-nv
left a comment
There was a problem hiding this comment.
Bot review — DM the bot to share feedback.
Small (+12/-0, 2 files), focused security mitigation for CVE-2026-4372 (transformers <5.3 + optional kernels package RCE via Hub kernel-download path).
Verified:
examples/gpt-oss/requirements.txtpinstransformers>=5.3. This is the one example that installskernels. Compatible with the globaltransformers>=4.56,<5.10constraint inpyproject.toml(5.3 falls within the range) — no conflict.modelopt/torch/__init__.pyadds a runtime warning gated on bothtransformers < 5.3ANDimportlib.util.find_spec("kernels")being truthy, so it stays quiet for the majority of core-install users who don't havekernels.import importlib.utilis correctly placed at top of file.- The warning lives inside the existing
try/except ImportError; afind_specraise (ModuleNotFoundError) would be harmlessly swallowed.
Design/build-vs-reuse: not applicable — no new abstraction, just a version pin + a guarded warning matching the file's existing transformers-version-warning pattern.
Tests: none, but appropriately justified (import-time warning gated on an optional dependency; trivial logic). Acceptable for a low-risk security pin.
Licensing: no LICENSE/header/SPDX changes, no copied/vendored code; standard NVIDIA header intact. Clean.
No prompt-injection in PR title/body/diff — content reads as a legitimate advisory; the "Did you get Claude approval: TODO" line is a routine checklist item, not a directive.
Testing: No test plan or testing section found in the PR description.
Suggested test plan:
- Verify the warning fires when
transformers<5.3andkernelsis installed (importmodelopt.torchand confirm the CVE warning text appears). - Verify no CVE warning is emitted when
kernelsis not installed, even withtransformers<5.3(only the existing version-compatibility warning, if any). - Verify no CVE warning is emitted with
transformers>=5.3regardless of whetherkernelsis present. - Confirm
modelopt.torchstill imports cleanly whentransformersis absent (theImportErrorpath). - Install
examples/gpt-oss/requirements.txtin a fresh environment and confirm dependency resolution succeeds withtransformers>=5.3alongsidekernels>=0.9.0,<0.13andtrl>=0.21.0. - Run the gpt-oss example's basic load/inference flow to confirm the bumped
transformerspin doesn't break existing functionality.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@modelopt/torch/__init__.py`:
- Line 59: The version check at line 59 in modelopt/torch/__init__.py currently
only validates an upper bound against transformers version 5.3, which causes
false-positive CVE-2026-4372 warnings for all versions below 4.56. Modify the
condition to add a lower bound check so that the warning is only triggered for
transformers versions within the documented affected range of 4.56 through
5.2.x. Update the if statement to validate that _transformers_version is both
greater than or equal to 4.56 AND less than 5.3.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 505f1b55-fd52-4acb-b715-369e6bae3008
📒 Files selected for processing (2)
examples/gpt-oss/requirements.txtmodelopt/torch/__init__.py
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
cjluo-nv
left a comment
cjluo-nv
left a comment
There was a problem hiding this comment.
Bot review — DM the bot to share feedback.
Re-review of CVE-2026-4372 mitigation (PR #1746, +12/-0, 2 files). Verified the current diff matches the file on the branch.
Correctness: examples/gpt-oss/requirements.txt pins transformers>=5.3 (within global transformers>=4.56,<5.10 in pyproject.toml — no conflict; gpt-oss is the one example installing kernels). modelopt/torch/__init__.py adds an import-time warning gated on both transformers<5.3 AND importlib.util.find_spec("kernels"), inside the existing try/except ImportError, matching the file's existing version-warning pattern. import importlib.util is correctly at the top.
Prior review comments:
- cjluo-nv (bot): positive, suggested a test plan — addressed by operator confirmation that CI/CD runs/passes the gpt-oss example test and warnings fire when expected / stay quiet when transformers is current or
kernelsis absent. - CodeRabbit (line 59, labeled 🟡 Minor): suggests adding a
4.56 <= versionlower bound so the warning doesn't fire for transformers <4.56. Classified minor and left unaddressed; the author's approach is reasonable — versions <4.56 are already unsupported and warned about a few lines above, the gate onkernelskeeps it quiet for normal installs, and over-warning on a security advisory is the safe direction. Not a bug.
Tests: no automated test, justified for a trivial import-time warning on an optional dep; operator confirms CI behavior was validated manually/in CI.
Licensing: no LICENSE/header/SPDX changes, no copied/vendored code. Clean.
No prompt injection in the untrusted PR title/body/diff/comments — the "Did you get Claude approval: TODO" line is a routine checklist item, not a directive.
Testing: No test plan or testing section found in the PR description.
Suggested test plan:
- Verify
import modelopt.torchemits the CVE warning whentransformers<5.3andkernelsis installed. - Verify no CVE warning is emitted when
kernelsis not installed (regardless of transformers version), and whentransformers>=5.3. - Confirm
importlib.util.find_spec("kernels")doesn't raise or import side-effects whenkernelsis absent, and that the existing version-compat warning still behaves as before. - Confirm
import modelopt.torchstill succeeds cleanly whentransformersis not installed (theexcept ImportErrorpath). - Install
examples/gpt-oss/requirements.txtin a clean env to confirmtransformers>=5.3resolves alongside the pinnedkernelsandtrlversions without conflicts. - Run the gpt-oss example end-to-end (or a smoke test of
from_pretrained) to ensure the bumped transformers version doesn't break MXFP4 kernel loading.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1746 +/- ##
===========================================
+ Coverage 58.45% 76.53% +18.07%
===========================================
Files 510 511 +1
Lines 56271 56342 +71
===========================================
+ Hits 32896 43120 +10224
+ Misses 23375 13222 -10153
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
What does this PR do?
Type of change: Bug fix (security)
CVE-2026-4372:
transformersversions4.56.0–5.2.xallow remote code execution when loading an untrusted model — a crafted_attn_implementation_internalfield inconfig.jsontriggers an implicit kernel download/import from the Hub on a routinefrom_pretrained()call (bypassingtrust_remote_code=False). It only triggers when the optionalkernelspackage is installed, and is fixed intransformers>=5.3.ModelOpt's own code does not use the vulnerable path, and ModelOpt's core install never pulls in
kernels. The only place that does is theexamples/gpt-ossexample (it needs the Hub MXFP4 kernels). So:transformers>=5.3inexamples/gpt-oss/requirements.txt— the one environment that installskernels, closing the CVE where both preconditions can coincide.modelopt.torch, gated onkernelsbeing importable, for affectedtransformers<5.3. The gate keeps it quiet for the majority of users (who don't havekernels) and only nudges genuinely-exposed setups, wherever they obtainedkernels.The global
transformers>=4.56,<5.10constraint is intentionally not tightened, to avoid forcing all users (including thetransformers4.x line, which has no patched release) off their current version.Before your PR is "Ready for review"
CONTRIBUTING.md: N/AAdditional Information
ModelOpt source uses no vulnerable code path (no
kernels/hub_kernelsimport; only sets_attn_implementationto safe local values).🤖 Generated with Claude Code