Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

LMDeploy — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in LMDeploy, with AI-generated Chinese analysis, references, and POCs.

Vendor: InternLM

CVE ID Title CVSS Severity Published
CVE-2026-123818 LMDeploy URL parser disagreement permits SSRF filter bypass CWE-918 7.5 High 2026-11-09
CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization CWE-502 9.8 Critical 2026-10-30
CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading CWE-400 8.8 High 2026-09-18
CVE-2025-66455 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py CWE-502 9.8 Critical 2026-09-18
CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch CWE-772 7.5 High 2026-09-17
CVE-2026-92971 InternLM LMDeploy through 0.17.0 Assertion Denial of Service CWE-617 7.5 High 2026-09-17
CVE-2025-59953 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy CWE-502 9.8 Critical 2026-09-16
CVE-2026-76850 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector CWE-502 9.8 Critical 2026-08-19
CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass CWE-918 8.6 High 2026-07-21
CVE-2026-46517 LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out CWE-94 7.8 High 2026-06-09
CVE-2026-46432 LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization CWE-94 7.8 High 2026-06-09
CVE-2026-33626 LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading CWE-918 7.5 High 2026-04-20
CVE-2025-67729 lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() CWE-502 8.8 High 2025-12-26
CVE-2025-3163 InternLM LMDeploy conf.py open code injection CWE-94 5.3 Medium 2025-04-03
CVE-2025-3162 InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization CWE-502 5.3 Medium 2025-04-03

All 15 known CVE vulnerabilities affecting LMDeploy with full Chinese analysis, references, and POCs where available.