CVE-2026-46432: LMDeploy before 0.13.0 always loads models with trust_remote_code=True, so a malicious model repo runs code
LMDeploy before 0.13.0 hardcodes trust_remote_code=True when it calls Hugging Face Transformers to read a model's config, with no way to opt out. If someone can control the model path a server loads, for example through deployment config or a platform where users submit model IDs, pointing it at a malicious Hugging Face repo runs that repo's Python code in the serving process. Fixed in 0.13.0.
What it is
lmdeploy/archs.py and lmdeploy/utils.py pass trust_remote_code=True to AutoConfig.from_pretrained(), PretrainedConfig.get_config_dict() and GenerationConfig.from_pretrained().
With that flag, Transformers may download and execute Python code shipped in the model repository during initialization.
The advisory confirmed lmdeploy 0.12.3 and earlier as affected. The first patched version is 0.13.0.
How to check
- Run pip show lmdeploy and see whether the version is below 0.13.0.
- Check who can set the model path or model ID your LMDeploy servers load (CI/CD, Kubernetes config, user-submitted model IDs).
How to fix
- Upgrade to LMDeploy 0.13.0 or later.
- Only serve models from repositories you trust, and pin them to a reviewed revision.
pip show lmdeploy | grep -i ^version
pip install -U 'lmdeploy>=0.13.0'Sources
- criticalCVE-2026-119706: LMDeploy api_server runs attacker pickles sent to /update_weights, unauthenticated RCE in 0.9.0 to 0.18.0, still unfixed
- criticalCVE-2025-66455: LMDeploy DistServe connects to attacker ZeroMQ peers and unpickles their messages, unauthenticated RCE before 0.16.0
- criticalCVE-2025-59953: LMDeploy's ZeroMQ RPC server unpickles incoming messages, remote code execution in 0.9.1 to 0.10.1
- highCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with url