Description
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.
Published: 2026-09-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate patch
AI Analysis

Impact

LMDeploy contains a code injection flaw where the quantization_config.quant_dtype value from a HuggingFace model is passed directly to eval without validation, allowing an attacker to execute arbitrary Python code when loading the model. This can lead to compromise of confidentiality, integrity, and availability of the system that runs lmdeploy.

Affected Systems

The vulnerability affects the InternLM lmdeploy toolkit, specifically versions 0.12.1 through 0.12.2. Versions 0.12.3 and later contain an official patch that mitigates the issue.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide a malicious model to the victim; the likely attack vector is a local or remote user who loads a model via lmdeploy, for example by hosting a crafted model on HuggingFace.

Generated by OpenCVE AI on September 19, 2026 at 11:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade lmdeploy to version 0.12.3 or later to apply the vendor patch.
  • Restrict model loading to trusted sources and explicitly validate or whitelist the quant_dtype value before passing it to eval.
  • If upgrading is temporarily infeasible, consider removing or replacing the eval call in lmdeploy/pytorch/config.py with a safe lookup or disabling model loading for untrusted models.

Generated by OpenCVE AI on September 19, 2026 at 11:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3hmm-rh5q-gwwr LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `quant_dtype` is passed to `eval(f'torch.{quant_dtype}')` without any validation. Version 0.12.3 contains a patch.
Title LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-18T17:13:37.133Z

Reserved: 2026-03-23T14:24:11.617Z

Link: CVE-2026-33625

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-18T18:17:06.640

Modified: 2026-09-18T18:17:06.640

Link: CVE-2026-33625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T12:00:08Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption