CVE-2026-46432
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution due to hardcoded 'trust_remote_code=True' in multiple HuggingFace model-loading call sites.
Risk Assessment
This vulnerability may lead to unauthorized code execution, posing a serious security threat to systems using LMDeploy. Organizations could be exposed to attacks that may result in data loss or system takeover.
Recommendation
It is recommended to update LMDeploy to the latest version as soon as a patch is released. In the meantime, consider disabling the 'trust_remote_code' option to minimize risk.
Original NVD description (English source)
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no publicly available patches.