CVE-2026-46517

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py
https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107
https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796
https://github.com/github/advisory-database/pull/4511
https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-10 00:16

Updated : 2026-08-31 15:17

NVD link : CVE-2026-46517

Mitre link : CVE-2026-46517

CVE.ORG link : CVE-2026-46517

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-46517", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46517", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T03:55:31.160135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "InternLM", "product": "lmdeploy", "versions": [{"status": "affected", "version": "<= 0.12.3"}]}]}], "published": "2026-06-10T00:16:53.827", "references": [{"url": "https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py", "source": "security-advisories@github.com"}, {"url": "https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107", "source": "security-advisories@github.com"}, {"url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796", "source": "security-advisories@github.com"}, {"url": "https://github.com/github/advisory-database/pull/4511", "source": "security-advisories@github.com"}, {"url": "https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-915"}, {"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded \"trust_remote_code=True\" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue."}, {"lang": "es", "value": "LMDeploy es un conjunto de herramientas para comprimir, desplegar y servir modelos de lenguaje grandes. En las versiones 0.12.3 y anteriores, el valor 'trust_remote_code=True' codificado de forma r\u00edgida permite RCE en la cadena de suministro de HF sin que el usuario lo autorice expl\u00edcitamente. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "lastModified": "2026-08-31T15:17:17.260", "sourceIdentifier": "security-advisories@github.com"}