CVE-2026-46517

7.8 Élevée

Publiée le 10/06/2026 à 02:16 · Modifiée le 31/08/2026 à 17:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

Traduire en français

Produits concernés

InternLM lmdeploy

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94
CWE-915
CWE-1188

Références

https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py
https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107
https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796
https://github.com/github/advisory-database/pull/4511
https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories