PT-2026-42668 · Lmdeploy · Lmdeploy

CVE-2026-46517 · Published 2026-05-21 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LMDeploy versions 0.12.3 and earlier

Description LMDeploy contains an implicit unsafe remote-code load path because it hardcodes the trust remote code=True parameter when fetching models. This configuration overrides the default-secure stance of HuggingFace Transformers, which requires an explicit opt-in to execute remote code. When a user loads a model from a repository, the software may automatically download and execute arbitrary Python code contained in configuration *.py files via the importlib module. This can lead to remote code execution (RCE) under the privileges of the LMDeploy process if a malicious repository is used.

The issue is present in several locations, including the get model arch() function, the quantization CLI, and the calibration helper. Specifically, the trust remote code variable is hardcoded to True in the following functions and files:

• get model arch() in lmdeploy/archs.py
• AutoTokenizer.from pretrained() and load hf from pretrained() in lmdeploy/lite/apis/calibrate.py
• AutoConfig.from pretrained() in lmdeploy/lite/utils/load.py

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-915

CWE-1188

Related Identifiers

CVE-2026-46517

GHSA-9XQ9-36W5-Q796

PYSEC-2026-2608

Affected Products

Lmdeploy

References · 13

• 🔥 https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46517.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-2608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46517 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46517 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9xq9-36w5-q796 · Vendor Advisory
• https://github.com/InternLM/lmdeploy · Note
• https://pypi.org/project/lmdeploy · Note
• https://reddit.com/r/cybersecurity/comments/1to25wg/14_npmpypiai_supplychain_threats_today_20260526 · Reddit Post
• https://t.me/cveNotify/167038 · Telegram Post
• https://t.me/CVEtracker/56382 · Telegram Post
• https://github.com/advisories/GHSA-9xq9-36w5-q796 · Note
• https://reddit.com/r/cybersecurity/comments/1tkfk0l/14_npmpypiai_supplychain_threats_today_20260522 · Reddit Post