CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
CriticalCVSS 9.3
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi lmdeploy | >= 0.9.0, <= 0.18.0 | No fix listed |
References
- GitHub Issue #4698 exploit issue-tracking
- github.com product
- github.com technical-description
- github.com technical-description
- github.com issue-tracking patch
- VulnCheck Advisory: LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization third-party-advisory