TI-2025-37341 Aliases CVE-2025-59953 GHSA-5h8j-6crg-7rmw

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

HIGH 82CWE-502Published 2026-09-16 · Updated 2026-09-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00875 59th percentileScored 2026-11-07

Fix Fixed lmdeploy (InternLM): 0.10.2lmdeploy (PyPI): 0.10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
InternLM	lmdeploy	0.9.1 to before 0.10.2	0.10.2	Patch available	CNA
—	lmdeploy (PyPI)	0.9.1 to before 0.10.2	0.10.2	Patch available	GHSA-5h8j-6crg-7rmw

lmdeploy VendorInternLM Affected 0.9.1 to before 0.10.2 Fixed in 0.10.2 Patch available CNA
lmdeploy (PyPI) Vendor— Affected 0.9.1 to before 0.10.2 Fixed in 0.10.2 Patch available GHSA-5h8j-6crg-7rmw

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:internlm:lmdeploy::::::::	—	—	InternLM

cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:* Versions — — ·InternLM

Remediation

Fix · CNA lmdeploy (InternLM) Fixed in 0.10.2
Fix · GHSA-5h8j-6crg-7rmw lmdeploy (PyPI) Fixed in 0.10.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-59953
2026-10-03 Alias added: GHSA-5h8j-6crg-7rmw

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-59953

Other 4

TI-2026-67516 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection CVSS 4.0CRITICAL 10.0
TI-2026-83181 Unauthenticated RCE in InternLM LMDeploy via pickle deserialization CVSS 4.0CRITICAL 9.3
TI-2026-53684 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector CVSS 4.0CRITICAL 9.3
TI-2026-62637 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch CVSS 4.0HIGH 8.7
TI-2026-62632 InternLM LMDeploy through 0.17.0 Assertion Denial of Service CVSS 4.0HIGH 8.7
TI-2026-45351 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass CVSS 4.0HIGH 7.7

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences