The vulnerability stems from a path traversal flaw in LM Studio’s model downloader resolveDownloadRequest. Attackers can supply backslash‑separated traversal filenames that write files outside the intended models directory. A malicious model repository can be crafted to place a plugin manifest.json, install‑state.json and mcp‑bridge‑config.json, which triggers an attacker‑supplied Python payload each time LM Studio launches, leading to arbitrary code execution under the user’s privileges.

Element Labs LM Studio versions prior to 0.4.22+1, as referenced in the changelog and advisory links. Any deployment of LM Studio that has not been updated to 0.4.22 or later is potentially vulnerable.

The CVSS score of 8.7 classifies this issue as high severity, although EPSS data is not available so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be local, requiring the user to download a malicious model repository, after which arbitrary code runs during application startup. Patch status and the ability of the user to verify model sources directly influence risk.