---
id: "CVE-2026-112140"
kind: "vulnerability"
aliases: ["CVE-2026-112140"]
title: "Doctor-Dignity: model_lib argument lets remote attackers inject code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "llSourcell/Doctor-Dignity", "fixed": [], "affected": "<= 3f2ffb6c892f13b50a708d05900d3227acb40ded (all commits, no releases)", "ecosystem": "github"}]
ecosystems: []
tags: ["doctor-dignity", "mlc-chat", "model-package", "other", "python", "untrusted-model"]
not_affected_if: ["only-trusted-model-packages", "project-not-used"]
published_at: "2026-10-19T12:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:41:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112140", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:41:26+00:00"}]
---

# Doctor-Dignity: model_lib argument lets remote attackers inject code

Doctor-Dignity's vendored MLC chat runtime builds a shared-library filename from the model_lib string in a model package's mlc-chat-config.json. It searches the package directory itself and loads the first match via tvm.runtime.load_module (dlopen). A malicious model package that ships its own .so therefore runs native code in the chat process when loaded. It is not a network service bug: the victim must load an attacker-supplied package. The reporter notes upstream mlc-llm of the same era has the same logic.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:llSourcell/Doctor-Dignity affected <= 3f2ffb6c892f13b50a708d05900d3227acb40ded (all commits, no releases) fixed ?

## How to check

- Check whether you use llSourcell/Doctor-Dignity (or a copy of its python/mlc_chat/chat_module.py) and whether _get_lib_module calls tvm.runtime.load_module on a path under the model package directory (around lines 339-374).
- Check the commit: the repo has no tagged releases; main HEAD 3f2ffb6c892f13b50a708d05900d3227acb40ded is affected.
- List what model packages you load and where they came from; any *-llvm.so or other .so inside a package directory is a red flag.

## Fix

No fix: the repository is unchanged since 2023-09-20 and issue #37 has had no response. Workaround: only load model packages you built or trust; delete unexpected .so files from package directories; pass an explicit lib_path from a trusted location. Reporter suggests allow-listed library locations and hash/signature verification.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112140
- 2026-10-25T03:41:26+00:00 analyst — Read upstream issue #37 (reporter's own PoC, open, no maintainer reply, repo unchanged since 2023-09-20) and VulDB submission. Not network-remote: needs victim to load a crafted model package whose mlc-chat-config.json model_lib selects a <model_lib>-<device>.so inside the package, dlopen'd by tvm.runtime.load_module. No fix exists. No verified fields: no vendor advisory.

## Documents

- [advisory] Doctor-Dignity #37: Arbitrary code execution via model_lib field https://github.com/llSourcell/Doctor-Dignity/issues/37
- [describes] VulDB submit #1013205 (Doctor-Dignity model_lib) https://vuldb.com/submit/1013205

## From the sources

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_