LMDeploy, a toolkit for deploying large language models, was found to execute arbitrary code through a hardcoded trust_remote_code=True flag in several HuggingFace model-loading calls. As a result, any model supplied to LMDeploy can contain malicious code that will run with the process’s privileges during initialization. This flaw is classified as code injection and satisfies CWE‑94, exposing the entire runtime to compromise.

The vulnerability affects InternLM’s lmdeploy product for all releases 0.12.3 and earlier. Systems that rely on these versions and load models from external or untrusted sources are at risk. No other vendors are listed.

The CVSS score of 7.8 indicates a high severity and the exploitability is enabled through model loading. The EPSS score is not available, but the vulnerability is not currently listed in CISA KEV, implying no known widespread exploitation at this time. An attacker can obtain compromise by supplying a malicious model, either locally or remotely, to an unpatched LMDeploy instance. Until a patch is released, the risk remains high and the flaw constitutes a critical exposure to the code base.