AI005 · STOA-LLM05-UNPINNED-MODEL
Model, endpoint, or artifact dependency observed without a pin or integrity control.
- OWASP: LLM05 Supply Chain (v1.1); LLM03 (2025).
- Severity: low–high by variant. Gates: no.
- Kind: pattern (no data flow). Fires per call site.
Detection — four variants
| variant | pattern | severity |
|---|---|---|
trust-remote-code | from_pretrained(..., trust_remote_code=True) | high |
unpinned-artifact | from_pretrained("org/model") with no revision=; torch.load/pickle.load of a downloaded artifact | medium |
floating-alias | a model string that is a known undated alias (gpt-4o, claude-3-5-sonnet, …) or ends -latest | low |
insecure-endpoint | base_url/api_base set to a plaintext non-local http:// URL (supersedes NET001); or read from config with no allowlist (dynamic_endpoint, info) | medium / info |
Not flagged: dated snapshots (gpt-4o-2024-08-06), revision=-pinned artifacts, local endpoints, alias strings in test paths. The alias table ships in data/model_aliases.toml and is overridable.
Vulnerable → remediated
# VULNERABLE
AutoModel.from_pretrained("someorg/reranker", trust_remote_code=True)
ChatOpenAI(model="gpt-4o", base_url=os.environ["LLM_BASE_URL"])
# REMEDIATED
AutoModel.from_pretrained("someorg/reranker", revision="a1b2c3d")
ChatOpenAI(model="gpt-4o-2024-08-06", base_url=validated_base)Finding message
{construct} permits execution of / loads repository-supplied code or a model artifact with no pin or integrity control observed (OWASP LLM05). Consider pinning a reviewed revision or dated snapshot.Suppress: # stoa: ignore[AI005] reason