Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
PYSEC-2026-4078
  • PyPI/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 2 days ago
  • Fix available
  • Severity - 8.8 (High)
PYSEC-2026-4077
  • PyPI/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 2 days ago
  • Fix available
  • Severity - 9.8 (Critical)
PYSEC-2026-4079
  • PyPI/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 2 days ago
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-39wr-7q6h-cf68
  • PyPI/lmdeploy
 LMDeploy has an SSRF bypass 18 Sep
  • Fix available
  • Severity - 7.5 (High)
GHSA-3hmm-rh5q-gwwr
  • PyPI/lmdeploy
 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 18 Sep
  • Fix available
  • Severity - 8.8 (High)
GHSA-2vh9-42vm-xmv2
  • PyPI/lmdeploy
 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 18 Sep
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-5h8j-6crg-7rmw
  • PyPI/lmdeploy
 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 16 Sep
  • Fix available
  • Severity - 9.8 (Critical)
PYSEC-2026-2608
  • PyPI/lmdeploy
 lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out 13 Jul
  • No fix available
  • Severity - 7.8 (High)
PYSEC-2026-2609
  • PyPI/lmdeploy
 LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization 13 Jul
  • Fix available
  • Severity - 7.8 (High)
PYSEC-2026-2607
  • PyPI/lmdeploy
 LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading 13 Jul
  • No fix available
  • Severity - 7.5 (High)
PYSEC-2026-1578
  • PyPI/lmdeploy
 lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() 07 Jul
  • Fix available
  • Severity - 8.8 (High)
PYSEC-2026-1579
  • PyPI/lmdeploy
 InternLM LMDeploy code injection vulnerability 07 Jul
  • No fix available
  • Severity - 4.8 (Medium)
PYSEC-2026-1577
  • PyPI/lmdeploy
 LMDeploy Improper Input Validation Vulnerability 07 Jul
  • No fix available
  • Severity - 4.8 (Medium)
GHSA-9xq9-36w5-q796
  • PyPI/lmdeploy
 lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out 21 May
  • Fix available
  • Severity - 7.8 (High)
GHSA-m549-qq94-fvhg
  • PyPI/lmdeploy
 LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization 21 May
  • Fix available
  • Severity - 7.8 (High)
GHSA-6w67-hwm5-92mq
  • PyPI/lmdeploy
 LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading 21 Apr
  • No fix available
  • Severity - 7.5 (High)
Load more...