CVE-2026-107204

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107204

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107204.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107204

Published

2026-10-07T15:24:03Z

Modified

2026-10-28T02:31:01Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

Details

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to import os and run operating system commands as the LMCache process.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107204.json"
}

References

Affected packages

Git / github.com/lmcache/lmcache

Affected ranges

Type

GIT

Repo

https://github.com/lmcache/lmcache

Events

Introduced

Last Affected

05a013b29da78cf2321b9b46ec5039dde2fb0bb0

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "0.5.5"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

Other

nightly

nightly-cu129

nightly-cu13

nightly-musa

nightly-rocm

nightly-rocm-2026-09-09

nightly-rocm-2026-09-09-cu129

nightly-rocm-2026-09-09-musa

nightly-rocm-2026-09-09-rocm

nightly-rocm-2026-09-09-rocm-torch210

nightly-rocm-2026-09-09-xpu

operator-latest

operator-nightly-latest

operator-v0.*

operator-v0.1.1

operator-v0.4.8rc1

operator-v0.5.0

operator-v0.5.0rc1

operator-v0.5.0rc2

operator-v0.5.0rc3

operator-v0.5.1

operator-v0.5.1rc1

operator-v0.5.2

operator-v0.5.3

operator-v0.5.3rc1

operator-v0.5.4

v0.*

v0.1.0-alpha

v0.1.1-alpha

v0.1.2-alpha

v0.1.3-alpha

v0.1.4-alpha

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.1.post1

v0.3.10

v0.3.10.post1

v0.3.10post2

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.3.9post1

v0.3.9post2

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.4-cu13

v0.4.5

v0.4.5-cu129

v0.4.6

v0.4.6-cu129

v0.4.7

v0.4.7-cu129

v0.4.8rc3

v0.4.8rc3-cu129

v0.4.8rc4

v0.4.8rc4-cu129

v0.5.0

v0.5.0-cu129

v0.5.0rc1

v0.5.0rc1-cu129

v0.5.1

v0.5.1-cu129

v0.5.1rc1

v0.5.1rc1-cu129

v0.5.1rc2

v0.5.1rc2-cu129

v0.5.2

v0.5.2-cu129

v0.5.2rc1

v0.5.2rc1-cu129

v0.5.3

v0.5.3-cu129

v0.5.3-rocm

v0.5.3.rc3

v0.5.3.rc3-rocm

v0.5.3rc1

v0.5.3rc1-cu129

v0.5.3rc1-rocm

v0.5.3rc2

v0.5.3rc2-cu129

v0.5.3rc2-rocm

v0.5.3rc3

v0.5.3rc3-cu129

v0.5.3rc3-rocm

v0.5.3rc4

v0.5.3rc4-cu129

v0.5.3rc4-rocm

v0.5.4

v0.5.4-cu129

v0.5.4rc1

v0.5.4rc1-cu129

v0.5.4rc1-rocm

v0.5.4rc2

v0.5.4rc2-cu129

v0.5.4rc2-rocm

v0.5.4rc3

v0.5.4rc3-cu129

v0.5.4rc4

v0.5.4rc4-cu129

v0.5.4rc4-rocm

v0.5.4rc5

v0.5.4rc5-cu129

v0.5.5

v0.5.5-cu129

v0.5.5-musa

v0.5.5-rocm

v0.5.5-rocm-torch210

v0.5.5-xpu

v0.5.5rc1

v0.5.5rc1-cu129

v0.5.5rc1-rocm

v0.5.5rc1-xpu

v0.5.5rc2

v0.5.5rc2-cu129

v0.5.5rc2-rocm

v0.5.5rc2-rocm-torch210

v0.5.5rc2-xpu

v0.5.5rc3

v0.5.5rc3-cu129

v0.5.5rc3-rocm

v0.5.5rc3-rocm-torch210

v0.5.5rc3-xpu

v0.5.5rc4

v0.5.5rc4-cu129

v0.5.5rc4-rocm

v0.5.5rc4-rocm-torch210

v0.5.5rc4-xpu

v0.5.5rc5

v0.5.5rc5-cu129

v0.5.5rc5-musa

v0.5.5rc5-rocm

v0.5.5rc5-rocm-torch210

v0.5.5rc5-xpu

v0.5.5rc6

v0.5.5rc6-cu129

v0.5.5rc6-rocm-torch210

v0.5.5rc7

v0.5.5rc7-cu129

v0.5.5rc7-musa

v0.5.5rc7-rocm

v0.5.5rc7-rocm-torch210

v0.5.5rc7-xpu

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107204.json"