LMDeploy - Server-Side Request Forgery

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery SSRF vulnerability in the vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or...

CVE-2026-33626-Lab

CVE-2026-33626 — LMDeploy Vision-Language SSRF Lab Overview This repository reproduces CVE-2026-33626 , a Server-Side Request Forgery SSRF vulnerability in LMDeploy's vision-language image loading path. The vulnerable behavior occurs when LMDeploy receives an image URL and the server-side image...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

EUVD-2026-114111

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706

InternLM LMDeploy versions 0.9.0 through 0.18.0 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The root cause is the insecure deserialization of untrusted data via the /update_weights endpoint. Specifically, the ForkingPickler.loads function fails to validate base...

PT-2026-133640

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions 0.9.0 through 0.18.0 Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the api server process. This occurs when the server receives specially crafte...

CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

PYSEC-2026-4078 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...

PYSEC-2026-4077 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used...

PYSEC-2026-4079 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

Description The LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a remote...

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

DescriptionThe LMdeployimplements anrpc server AsyncRPCServer in zmqrpc.pyfor supporting the RPC communications. In its core functionalitycallandresponse, I found it will directly use thepickles.loadsto deserialize the received messages without any sanitization, hence resulting in a remote code...

PT-2026-105832

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recv pyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recv pyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address us...

PT-2026-105833

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization config.quant dtype value. When a user loads the model with...

PT-2026-105834

Description The LMdeploy implements an rpc server AsyncRPCServer in zmq rpc.py for supporting the RPC communications. In its core functionality call and response, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a...