From dcf886007de4b8e5200f461a13233315f897fb9d Mon Sep 17 00:00:00 2001 From: Xuan-Son Nguyen Date: Fri, 2 May 2025 08:45:10 +0200 Subject: [PATCH] convert : explicitly disable trust_remote_code for AutoConfig (#13246) --- convert_hf_to_gguf.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/convert_hf_to_gguf.py b/convert_hf_to_gguf.py index 04ca646b5..df3f8a55d 100755 --- a/convert_hf_to_gguf.py +++ b/convert_hf_to_gguf.py @@ -419,7 +419,9 @@ class ModelBase: @staticmethod def load_hparams(dir_model: Path): try: - return AutoConfig.from_pretrained(dir_model).to_dict() + # for security reason, we don't allow loading remote code by default + # if a model need remote code, we will fallback to config.json + return AutoConfig.from_pretrained(dir_model, trust_remote_code=False).to_dict() except Exception as e: logger.warning(f"Failed to load model config from {dir_model}: {e}") logger.warning("Trying to load config.json instead")