LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...

CVE-2025-66455: Deserialization of Untrusted Data

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements...

rastervision (>=0.20.0, <=0.20.2), rastervision-core (>=0.20.0, <=0.20.2) +3 more potentially affected by CVE-2025-69662 via geopandas (0.12.0)

geopandas PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on geopandas and may be impacted: - rastervision =0.20.0, =0.20.0, =0.20.0, =0.20.0, =0.3.7, =0.4.1 Source cves: CVE-2025-69662 Source advisory: OSV:GHSA-6497-PRX7-GPMQ...

rastervision (>=0.20.0, <=0.20.2), rastervision-core (>=0.20.0, <=0.20.2) +3 more potentially affected by CVE-2025-69662 via geopandas (0.12.0)

geopandas PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on geopandas and may be impacted: - rastervision =0.20.0, =0.20.0, =0.20.0, =0.20.0, =0.3.7, =0.4.1 Source cves: CVE-2025-69662 Source advisory: OSV:PYSEC-2026-62...