4c8137a7af
load_prequantized_transformer ends in torch.load(weights_only=False), which executes arbitrary code from the pickle. The transformer_prequant_path load-request field reached that unpickle for any local file an authenticated caller named, so a request could trigger remote code execution. Refuse the source.kind=='path' branch unless the operator sets UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH=1; the first-party hosted-repo checkpoint stays trusted and unaffected. Document the requirement on the API field and add gate tests. |
||
|---|---|---|
| .. | ||
| .gitkeep | ||
| __init__.py | ||
| auth.py | ||
| data_recipe.py | ||
| datasets.py | ||
| export.py | ||
| inference.py | ||
| mcp_servers.py | ||
| models.py | ||
| providers.py | ||
| responses.py | ||
| training.py | ||
| users.py | ||