LLM frameworks · InternLM
LMDeploy
InternLM's open-source toolkit for compressing, deploying and serving large language models.
5Advisories
3critical
2high
0medium
2026-11-09Latest
Timeline · advisories per quarter
12026 Q2
22026 Q3
22026 Q4
Named in sources
Reported for LMDeploy
01. CVE-2026-119706: LMDeploy api_server runs attacker pickles sent to /update_weights, unauthenticated RCE in 0.9.0 to 0.18.0, still unfixedInternLM LMDeploy 0.9.0 through 0.18.0 deserializes base64 pickle data sent to the api_server's /update_weights endpoint without validation, so anyone who can reach the server can run OS commands as the api_server process. The fix pull request (#4964) is still open and 0.18.0 is the latest release, so keep the server off untrusted networks and block that endpoint. LMDeploy 2026-10-30 02. CVE-2025-66455: LMDeploy DistServe connects to attacker ZeroMQ peers and unpickles their messages, unauthenticated RCE before 0.16.0LMDeploy 0.9.2 up to 0.16.0, when PD-disaggregation (DistServe) is enabled on the PyTorch backend, lets anyone who can reach the API server pass a ZeroMQ address to POST /distserve/p2p_connect. The engine connects to it and deserializes what it receives with pickle, so a malicious peer runs code in the serving process. Upgrade to 0.16.0. The same bug was also filed by VulnCheck as CVE-2026-76850. LMDeploy 2026-09-18 03. CVE-2025-59953: LMDeploy's ZeroMQ RPC server unpickles incoming messages, remote code execution in 0.9.1 to 0.10.1LMDeploy 0.9.1 up to 0.10.2 runs an RPC server (AsyncRPCServer in zmq_rpc.py) whose call_and_response() passes received messages straight to pickle.loads(). The server doesn't check where connections come from, so anyone on the network who finds its port can send a crafted pickle and get code execution. Upgrade to 0.10.2 or later. LMDeploy 2026-09-16 04. CVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlLMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. LMDeploy 2026-11-09 05. CVE-2026-46432: LMDeploy before 0.13.0 always loads models with trust_remote_code=True, so a malicious model repo runs codeLMDeploy before 0.13.0 hardcodes trust_remote_code=True when it calls Hugging Face Transformers to read a model's config, with no way to opt out. If someone can control the model path a server loads, for example through deployment config or a platform where users submit model IDs, pointing it at a malicious Hugging Face repo runs that repo's Python code in the serving process. Fixed in 0.13.0. LMDeploy 
Hugging Face 2026-05-21
LMDeploy 2026-10-30 02. CVE-2025-66455: LMDeploy DistServe connects to attacker ZeroMQ peers and unpickles their messages, unauthenticated RCE before 0.16.0LMDeploy 0.9.2 up to 0.16.0, when PD-disaggregation (DistServe) is enabled on the PyTorch backend, lets anyone who can reach the API server pass a ZeroMQ address to POST /distserve/p2p_connect. The engine connects to it and deserializes what it receives with pickle, so a malicious peer runs code in the serving process. Upgrade to 0.16.0. The same bug was also filed by VulnCheck as CVE-2026-76850. LMDeploy 2026-09-18 03. CVE-2025-59953: LMDeploy's ZeroMQ RPC server unpickles incoming messages, remote code execution in 0.9.1 to 0.10.1LMDeploy 0.9.1 up to 0.10.2 runs an RPC server (AsyncRPCServer in zmq_rpc.py) whose call_and_response() passes received messages straight to pickle.loads(). The server doesn't check where connections come from, so anyone on the network who finds its port can send a crafted pickle and get code execution. Upgrade to 0.10.2 or later. LMDeploy 2026-09-16 04. CVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlLMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. LMDeploy 2026-11-09 05. CVE-2026-46432: LMDeploy before 0.13.0 always loads models with trust_remote_code=True, so a malicious model repo runs codeLMDeploy before 0.13.0 hardcodes trust_remote_code=True when it calls Hugging Face Transformers to read a model's config, with no way to opt out. If someone can control the model path a server loads, for example through deployment config or a platform where users submit model IDs, pointing it at a malicious Hugging Face repo runs that repo's Python code in the serving process. Fixed in 0.13.0. LMDeploy Hugging Face 2026-05-21