{"id":"CVE-2026-119706","published":"2026-10-30T16:17:51.673","lastModified":"2026-10-30T16:17:51.840","description":"InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://github.com/InternLM/lmdeploy","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/issues/4698","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/pull/4964","tags":[]},{"url":"https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/issues/4698","tags":[]}],"exploitRefs":[{"url":"https://github.com/InternLM/lmdeploy","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/issues/4698","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/pull/4964","tags":[]},{"url":"https://github.com/InternLM/lmdeploy/issues/4698","tags":[]}],"hasPoc":true,"ai":{"summary":"InternLM LMDeploy versions 0.9.0 through 0.18.0 contain an unauthenticated remote code execution (RCE) flaw in the /update_weights endpoint due to unsafe deserialization of pickled data via ForkingPickler.loads without validation, allowing attackers to execute arbitrary OS commands as the api_server process.","exploitability":"Exploitation is trivial for remote attackers since no authentication or user interaction is required and the vulnerable endpoint accepts base64-encoded malicious payloads directly.","blast_radius":"Successful exploitation grants full system compromise of the host running the api_server, enabling data theft, service disruption, or lateral movement within the infrastructure.","remediation":"Upgrade to LMDeploy version 0.19.0 or later, which addresses this vulnerability by validating and sanitizing serialized data before deserialization.","detection":"Defenders should monitor for anomalous POST requests to /update_weights containing base64-encoded payloads with pickle-like signatures (e.g., 'B64:800495...' or 'B64:80027d...'), especially when accompanied by child process creation or unexpected network connections from the api_server process.","tags":["rce","pickle-deserialization","unauthenticated","web-api","ics"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:46:53.203Z"}}