Advisoriesby Ibis
LMDeploy security advisories
10 advisories · 8 critical or high in 12 months · latest Sep 18
10 advisories
LMDeploy has an SSRF bypassCVE-2026-123818fixed in 0.15.0LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingCVE-2026-33625fixed in 0.12.3LMDeploy: unsafe deserializationCVE-2025-66455fixed in 0.16.0LMDeploy: remote code executionCVE-2025-59953fixed in 0.10.2lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outCVE-2026-46517fixed in 0.13.0LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initializationCVE-2026-46432fixed in 0.13.0LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingCVE-2026-33626no fix yetlmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()CVE-2025-67729fixed in 0.11.1InternLM LMDeploy code injection vulnerabilityCVE-2025-3163no fix yetLMDeploy Improper Input Validation VulnerabilityCVE-2025-3162no fix yet