CVE-2026-119706— LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

Quick assessment

Affected

InternLM lmdeploy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

InternLM LMDeploy 0.9.0 至 0.18.0 版本存在一个无需认证的远程代码执行漏洞。攻击者可通过向接口发送经过序列化（pickled）的数据，从而在服务器上执行操作系统命令。具体而言，攻击者可在参数中提交精心构造的、经 Base64 编码的 pickle 数据；该数据会被函数在未经任何验证的情况下反序列化，最终导致以进程身份执行恶意命令。

CVSS 9.8 · Critical Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

Source: CVE Program / CVE List V5

Vulnerability Description

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
InternLM	lmdeploy	0.9.0 ~ 0.18.0	-

II. Public POCs for CVE-2026-119706

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119706

请登录查看更多情报信息。

Other References for CVE-2026-119706 (1)

🔗 GitHub - InternLM/lmdeploy: LMDeploy is a toolkit for compressing, deploying, and serving LLMs. · GitHub Read full article product

Other References for CVE-2026-119706 (5)

https://github.com/InternLM/lmdeploy/pull/4964 patch issue-tracking
https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345 technical-description
https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60 technical-description
https://github.com/InternLM/lmdeploy/issues/4698 issue-tracking
https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119706

IV. Related Vulnerabilities

Same product: lmdeploy

Same vendor: InternLM

Same weakness: CWE-502