LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

Description The LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a remote...

GHSA-5H8J-6CRG-7RMW LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

Description The LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a remote...

PT-2026-93885

Description The LMdeploy implements an rpc server AsyncRPCServer in zmq rpc.py for supporting the RPC communications. In its core functionality call and response, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a...

PT-2026-93819

Name of the Vulnerable Software and Affected Versions LMDeploy versions 0.9.1 through 0.10.1 Description LMDeploy implements an RPC server via AsyncRPCServer in zmq rpc.py to support RPC communications. The call and response function uses pickle.loads to deserialize received messages without prop...

CVE-2025-59953: Deserialization of Untrusted Data

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found i...

alignment-handbook (0.1.0), geniebottle (0.0.3) +7 more potentially affected by CVE-2026-9856 via transformers (4.37.1)

transformers PYPI version 4.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.1.0 - geniebottle 0.0.3 - llm-docstring-generator 1.0.0 - lmdeploy =0.2.3, =0.0.2, =0.0.6, =0.0.7 - video2dataset...

EUVD-2026-62972

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

CVE-2026-76850

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

CVE-2026-76850

LMDeploy (InternLM) is vulnerable to remote code execution via unsafe pickle deserialization in its disaggregated-serving peer connector. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py deserializes peer-to-peer messages with pickle.loads() before any type validation,...

CVE-2026-76850 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

CVE-2026-76850 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

CVE-2026-76850 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

CVE-2026-76850: Deserialization of Untrusted Data

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handlezmqrecv coroutine in lmdeploy/pytorch/disagg/conn/engineconn.py reads peer-to-peer cache-free requests with recvpyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

PT-2026-78835

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle zmq recv coroutine in lmdeploy/pytorch/disagg/conn/engine conn.py reads peer-to-peer cache-free requests with recv pyobj, which deserializes the received bytes with pickle.loads, and the isinstance check against...

alignment-handbook (0.1.0), geniebottle (0.0.3) +7 more potentially affected by CVE-2026-9856 via transformers (4.37.1)

transformers PYPI version 4.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - alignment-handbook 0.1.0 - geniebottle 0.0.3 - llm-docstring-generator 1.0.0 - lmdeploy =0.2.3, =0.0.2, =0.0.6, =0.0.7 - video2dataset...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764

LMDeploy prior to 0.14.0 contains a server-side request forgery (SSRF) in the _load_http_url function of the media handler. The private-IP guard validates only the original URL; after HTTP redirects, hosts are not re-validated. An unauthenticated attacker can submit a crafted image_url to the cha...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...