Read the docs
TI-2026-26007 Aliases CVE-2026-33625GHSA-3hmm-rh5q-gwwr

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Priority HIGH 73CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00442 38th percentileScored 2026-11-07
Fix Fixed lmdeploy (InternLM): 0.12.3lmdeploy (PyPI): 0.12.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InternLMlmdeploy0.12.1 to before 0.12.30.12.3Patch availableCNA
—lmdeploy (PyPI)0.12.1 to before 0.12.30.12.3Patch availableGHSA-3hmm-rh5q-gwwr
  • lmdeploy VendorInternLM Affected 0.12.1 to before 0.12.3 Fixed in 0.12.3 Patch available CNA
  • lmdeploy (PyPI) Vendor— Affected 0.12.1 to before 0.12.3 Fixed in 0.12.3 Patch available GHSA-3hmm-rh5q-gwwr

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*——InternLM
  • cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:* Versions — — ·InternLM

Remediation

  • Fix · CNA lmdeploy (InternLM) Fixed in 0.12.3
  • Fix · GHSA-3hmm-rh5q-gwwr lmdeploy (PyPI) Fixed in 0.12.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33625
  2. 2026-10-03 Alias added: GHSA-3hmm-rh5q-gwwr

References

Other 3

  • TI-2026-67516 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection CVSS 4.0CRITICAL 10.0
  • TI-2025-37341 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy CVSS 3.1CRITICAL 9.8
  • TI-2026-83181 Unauthenticated RCE in InternLM LMDeploy via pickle deserialization CVSS 4.0CRITICAL 9.3
  • TI-2026-53684 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector CVSS 4.0CRITICAL 9.3
  • TI-2026-62637 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch CVSS 4.0HIGH 8.7
  • TI-2026-62632 InternLM LMDeploy through 0.17.0 Assertion Denial of Service CVSS 4.0HIGH 8.7
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences