Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-4078
  • PyPI/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 4 days ago
  • Fix available
  • Severity - 8.8 (High)
PYSEC-2026-4077
  • PyPI/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 4 days ago
  • Fix available
  • Severity - 9.8 (Critical)
PYSEC-2026-4079
  • PyPI/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 4 days ago
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-39wr-7q6h-cf68
  • PyPI/lmdeploy
 LMDeploy has an SSRF bypass 18 Sep
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-33625
  • github.com/internlm/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 18 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-3hmm-rh5q-gwwr
  • PyPI/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 18 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-2vh9-42vm-xmv2
  • PyPI/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 18 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2025-66455
  • github.com/internlm/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 18 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2026-92983
  • github.com/internlm/lmdeploy
 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch 17 Sep
  • Fix available
  • Severity - 8.7 (High)
CVE-2026-92971
  • github.com/internlm/lmdeploy
 InternLM LMDeploy through 0.17.0 Assertion Denial of Service 17 Sep
  • Fix available
  • Severity - 8.7 (High)
CVE-2025-59953
  • github.com/internlm/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 16 Sep
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-5h8j-6crg-7rmw
  • PyPI/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 16 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2026-76850
  • github.com/internlm/lmdeploy
 LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector 19 Aug
  • Fix available
  • Severity - 9.3 (Critical)
CVE-2026-63764
  • github.com/internlm/lmdeploy
 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass 21 Jul
  • Fix available
  • Severity - 7.7 (High)
PYSEC-2026-2608
  • PyPI/lmdeploy
 lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out 13 Jul
  • No fix available
  • Severity - 7.8 (High)
PYSEC-2026-2609
  • PyPI/lmdeploy
 LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization 13 Jul
  • Fix available
  • Severity - 7.8 (High)
Load more...