LMDeploy, a toolkit for compressing, deploying, and serving large language models, has a hardcoded configuration that sets trust_remote_code=True in versions 0.12.3 and earlier. This setting allows automatic loading of code from Hugging Face model repositories without user opt‑in, creating a potential remote code execution path. Attackers who can supply or modify a model payload can have malicious code executed during model loading, with the same privileges as the LMDeploy process.

The affected product is InternLM’s LMDeploy, specifically all releases up to and including 0.12.3. The issue is fixed in version 0.13.0, so upgrading removes the risk.

The CVSS score of 7.8 indicates a high‑severity flaw. The EPSS score is 0.00148, indicating a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, but the nature of the flaw—automatic loading of untrusted code—creates a high likelihood of exploitation by attackers with access to the model repository or deployment environment. The attack vector is remote, leveraging the model loading mechanism; an attacker can supply or modify a model definition that contains malicious code which will be executed during deployment.