CVE-2026-76850

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

CVE-2026-76850

LMDeploy (InternLM) is vulnerable to remote code execution via unsafe pickle deserialization in its disaggregated-serving peer connector. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py deserializes peer-to-peer messages with pickle.loads() before any type validation,...