internlm/lmdeploy Security Advisories | GitStock

high2026-09-18

LMDeploy has an SSRF bypass

GHSA-39wr-7q6h-cf68

high2026-09-18

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

GHSA-3hmm-rh5q-gwwr · CVE-2026-33625

critical2026-09-18

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

GHSA-2vh9-42vm-xmv2 · CVE-2025-66455

critical2026-09-16

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

GHSA-5h8j-6crg-7rmw · CVE-2025-59953

high2026-05-21

lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

GHSA-9xq9-36w5-q796 · CVE-2026-46517

high2026-05-21

LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

GHSA-m549-qq94-fvhg · CVE-2026-46432

high2026-04-21

LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

GHSA-6w67-hwm5-92mq · CVE-2026-33626

high2025-12-26

lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()

GHSA-9pf3-7rrr-x5jh · CVE-2025-67729

medium2025-04-03

InternLM LMDeploy code injection vulnerability

GHSA-jfvg-qm4p-473x · CVE-2025-3163

medium2025-04-03

LMDeploy Improper Input Validation Vulnerability

GHSA-7vc5-mjwp-c8fq · CVE-2025-3162