LMDeploy deserializes data received from a peer‑to‑peer ZMQ connection with Python's unsafe pickle.loads() before validating the request type, enabling an attacker to send a malicious byte stream that executes arbitrary Python code in the engine process. This flaw is a classic unsafe deserialization vulnerability (CWE‑502) that directly permits an attacker to gain full control of a vulnerable deployment.

The vulnerability exists in the InternLM lmdeploy product when the disaggregated serving mode is enabled, such as in version 0.15.0 and earlier. Any deployment that activates the p2p_connect flow—triggered via POST /distserve/p2p_initialize and /distserve/p2p_connect—exposes the flaw if authentication is disabled and the engine accepts connections from a caller‑controlled ZMQ address.

With a CVSS score of 9.3 the flaw is classified as critical. Because the endpoint that supplies the serialized data is selected by the caller and the API endpoints do not require authentication by default, a remote attacker can trivially supply a malicious ZMQ endpoint and trigger execution of arbitrary code in the engine. Although the EPSS score is not available and the vulnerability is not listed in KEV, the lack of authentication and the nature of the deserialization mean that exploitation is straightforward and the risk to affected systems is extremely high.