LMDeploy, a toolkit for compressing, deploying, and serving large language models, contains a hardcoded configuration that sets trust_remote_code=True in versions 0.12.3 and earlier. This disables the safety check that normally requires user opt‑in, allowing malicious code supplied through a Hugging Face model repository to be executed automatically during model loading. The vulnerability can lead to remote code execution or full system compromise if an attacker controls the model payload, as the code runs with the same privileges as the LMDeploy process.

The affected product is InternLM’s LMDeploy, specifically all releases up to and including 0.12.3. No patch is currently available; the vulnerability exists in the pre‑0.12.3 code base.

The CVSS score of 7.8 indicates a high‑severity flaw. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the nature of the flaw—automatic loading of untrusted code—creates a high likelihood of exploitation by attackers with access to the model repository or deployment environment. The attack vector is remote, leveraging the model loading mechanism; an attacker can supply or modify a model definition that contains malicious code which will be executed during deployment.