{"id":"CVE-2026-119706","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-119706","summary":"InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the…","details":"InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.","published":"2026-10-30T16:17:51.673","modified":"2026-10-30T16:17:51.840","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/InternLM/lmdeploy/pull/4964","label":"InternLM/lmdeploy#4964"},"references":[{"type":"WEB","url":"https://github.com/InternLM/lmdeploy"},{"type":"WEB","url":"https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60"},{"type":"WEB","url":"https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345"},{"type":"WEB","url":"https://github.com/InternLM/lmdeploy/issues/4698"},{"type":"WEB","url":"https://github.com/InternLM/lmdeploy/pull/4964"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization"},{"type":"WEB","url":"https://github.com/InternLM/lmdeploy/issues/4698"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-30T16:17:51.840"}}