lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

🗓️ 13 Jul 2026 15:19:10Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

LMDeploy hardcodes trust_remote_code=True, creating an implicit unsafe remote-code path with no opt-out; fix uses --trust-remote-code default False.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-46517	10 Jun 202600:53	–	circl
CNNVD	lmdeploy 代码注入漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-46517	9 Jun 202623:05	–	cve
Cvelist	CVE-2026-46517 LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out	9 Jun 202623:05	–	cvelist
EUVD	EUVD-2026-35874	9 Jun 202623:05	–	euvd
Github Security Blog	lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out	21 May 202619:33	–	github
NVD	CVE-2026-46517	10 Jun 202600:16	–	nvd
OSV	CVE-2026-46517 LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out	9 Jun 202623:05	–	osv
OSV	GHSA-9XQ9-36W5-Q796 lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out	21 May 202619:33	–	osv
OSV	PYSEC-2026-2608 lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out	13 Jul 202615:19	–	osv

Vulners

Node

Source	Link
github	www.github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-46517
github	www.github.com/InternLM/lmdeploy
pypi	www.pypi.org/project/lmdeploy
github	www.github.com/advisories/GHSA-9xq9-36w5-q796

13 Jul 2026 16:04Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.8

EPSS0.00148

SSVC