Doctor Dignity
Monthly
Code injection in Doctor-Dignity's MLC Chat module (_get_lib_module in python/mlc_chat/chat_module.py) allows an attacker who controls the model_lib argument to execute arbitrary code when a victim loads the attacker-supplied model library; publicly available exploit code exists, but there is no CISA KEV entry confirming active exploitation. The independent assessment rates real-world priority LOW because the attack is local (AV:L) and requires user interaction (UI:R) to load a malicious model configuration, rather than reaching an exposed network service.
Code injection in Doctor-Dignity's MLC Chat module (_get_lib_module in python/mlc_chat/chat_module.py) allows an attacker who controls the model_lib argument to execute arbitrary code when a victim loads the attacker-supplied model library; publicly available exploit code exists, but there is no CISA KEV entry confirming active exploitation. The independent assessment rates real-world priority LOW because the attack is local (AV:L) and requires user interaction (UI:R) to load a malicious model configuration, rather than reaching an exposed network service.