Unsafe eval() on env-var strings in modeling_minimax_m1.py (arbitrary code execution)

[chirag127]

Problem

modeling_minimax_m1.py calls eval() on unvalidated environment-variable strings at import time, allowing arbitrary Python execution.

File:line

modeling_minimax_m1.py:47-50:

use_triton = eval(os.environ.get("use_triton", default="False"))
debug = eval(os.environ.get("debug", default="False"))
do_eval = eval(os.environ.get("do_eval", default="False"))
eval_and_not_generate = eval(os.environ.get("eval_and_not_generate", default="False"))

Steps

1. export debug='__import__("os").system("touch /tmp/pwn")'
2. python -c "from transformers import AutoModelForCausalLM; AutoModelForCausalLM.from_pretrained('MiniMaxAI/MiniMax-M1-40k', trust_remote_code=True)"

Expected

Boolean parse only.

Actual

Arbitrary code runs at import (README/docs require trust_remote_code=True, so users cannot audit trivially).

Fix

Replace with os.environ.get("debug", "False").lower() == "true".

Env

transformers 4.45.2 (per config.json), Python 3.10+.

Thanks for maintaining MiniMax-AI/MiniMax-M1!