LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Priority LOW 35CWE-1188Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-915 and CWE-94.
Summary
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix Fixed lmdeploy (PyPI): 0.13.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| InternLM | lmdeploy | up to 0.12.3 | — | No fix listed | CNA |
| — | lmdeploy (PyPI) | before 0.13.0 | 0.13.0 | Patch available | GHSA-9xq9-36w5-q796 |
- lmdeploy VendorInternLM Affected up to 0.12.3 Fixed in — No fix listed CNA
- lmdeploy (PyPI) Vendor— Affected before 0.13.0 Fixed in 0.13.0 Patch available GHSA-9xq9-36w5-q796
Remediation
- Fix · GHSA-9xq9-36w5-q796 lmdeploy (PyPI) Fixed in 0.13.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46517
- 2026-10-03 Alias added: GHSA-9xq9-36w5-q796
References
Other 7
- https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796
- https://github.com/github/advisory-database/pull/4511
- https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107
- https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py
- https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0
- https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml
- https://github.com/InternLM/lmdeploy
More InternLM vulnerabilities
- TI-2026-67516 InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection CVSS 4.0CRITICAL 10.0
- TI-2025-37341 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy CVSS 3.1CRITICAL 9.8
- TI-2026-83181 Unauthenticated RCE in InternLM LMDeploy via pickle deserialization CVSS 4.0CRITICAL 9.3
- TI-2026-53684 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector CVSS 4.0CRITICAL 9.3
- TI-2026-62637 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch CVSS 4.0HIGH 8.7
- TI-2026-62632 InternLM LMDeploy through 0.17.0 Assertion Denial of Service CVSS 4.0HIGH 8.7
Sources
- CVE-2026-46517 · CVE Program
- CVE-2026-46517 · NVD
- FIRST EPSS
- GHSA-9xq9-36w5-q796 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences