Vulnerability Description
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/InternLM/lmdeploy
- https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoint
- https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.p
- https://github.com/InternLM/lmdeploy/issues/4698
- https://github.com/InternLM/lmdeploy/pull/4964
- https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticat
- https://github.com/InternLM/lmdeploy/issues/4698
FAQ
What is CVE-2026-119706?
CVE-2026-119706 is a vulnerability with a CVSS score of 9.8 (CRITICAL). InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights en...
How severe is CVE-2026-119706?
CVE-2026-119706 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-119706?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.