Internlm Lmdeploy
14 CVEs affecting Internlm Lmdeploy. Latest disclosed: 2026-10-30. Critical: 4, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-119706 | Critical | 9.8 | 2026-10-30 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sendi… |
CVE-2025-66455 | Critical | 9.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch… |
CVE-2025-59953 | Critical | 9.8 | 2026-09-16 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implem… |
CVE-2026-76850 | Critical | 9.8 | 2026-08-19 | LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-… |
CVE-2026-33625 | High | 8.8 | 2026-09-18 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `l… |
CVE-2025-67729 | High | 8.8 | 2025-12-26 | LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where… |
CVE-2026-63764 | High | 8.6 | 2026-07-21 | LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connect… |
CVE-2026-46517 | High | 7.8 | 2026-06-10 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables H… |
CVE-2026-46432 | High | 7.8 | 2026-06-10 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code exe… |
CVE-2026-92983 | High | 7.5 | 2026-09-17 | InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session… |
CVE-2026-92971 | High | 7.5 | 2026-09-17 | InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to t… |
CVE-2026-33626 | High | 7.5 | 2026-04-20 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnera… |
CVE-2025-3163 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file l… |
CVE-2025-3162 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/… |