LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious .bin or .pt model file. This issue has been patched in version 0.11.1.

Affected: PyPI: lmdeploy

## Summary

An insecure deserialization vulnerability exists in lmdeploy where `torch.load()` is called without the `weights_only=True` parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious `.bin` or `.pt` model file.

**CWE:** CWE-502 - Deserialization of Untrusted Data

---

## Details

Several locations in lmdeploy use `torch.load()` without the recommended `weights_only=True` security parameter. PyTorch's `torch.load()` uses Python's pickle module internally, which can execute arbitrary code during deserialization.

### Vulnerable Locations

**1. `lmdeploy/vl/model/utils.py` (Line 22)**

```python def load_weight_ckpt(ckpt: str) -> Dict[str, torch.Tensor]: """Load checkpoint.""" if ckpt.endswith('.safetensors'): return load_file(ckpt) # Safe - uses safetensors else: return torch.load(ckpt) # ← VULNERABLE: no weights_only=True ```

**2. `lmdeploy/turbomind/deploy/loader.py` (Line 122)**

```python class PytorchLoader(BaseLoader): def items(self): params = defaultdict(dict) for shard in self.shards: misc = {} tmp = torch.load(shard, map_location='cpu') # ← VULNERABLE ```

**Additional vulnerable locations:** - `lmdeploy/lite/apis/kv_qparams.py:129-130` - `lmdeploy/lite/apis/smooth_quant.py:61` - `lmdeploy/lite/apis/auto_awq.py:101` - `lmdeploy/lite/apis/get_small_sharded_hf.py:41`

### Note: Secure Pattern…

Affected: PyPI: lmdeploy

## Summary

An insecure deserialization vulnerability exists in lmdeploy where `torch.load()` is called without the `weights_only=True` parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious `.bin` or `.pt` model file.

**CWE:** CWE-502 - Deserialization of Untrusted Data

---

## Details

Several locations in lmdeploy use `torch.load()` without the recommended `weights_only=True` security parameter. PyTorch's `torch.load()` uses Python's pickle module internally, which can execute arbitrary code during deserialization.

### Vulnerable Locations

**1. `lmdeploy/vl/model/utils.py` (Line 22)**

```python def load_weight_ckpt(ckpt: str) -> Dict[str, torch.Tensor]: """Load checkpoint.""" if ckpt.endswith('.safetensors'): return load_file(ckpt) # Safe - uses safetensors else: return torch.load(ckpt) # ← VULNERABLE: no weights_only=True ```

**2. `lmdeploy/turbomind/deploy/loader.py` (Line 122)**

```python class PytorchLoader(BaseLoader): def items(self): params = defaultdict(dict) for shard in self.shards: misc = {} tmp = torch.load(shard, map_location='cpu') # ← VULNERABLE ```

**Additional vulnerable locations:** - `lmdeploy/lite/apis/kv_qparams.py:129-130` - `lmdeploy/lite/apis/smooth_quant.py:61` - `lmdeploy/lite/apis/auto_awq.py:101` - `lmdeploy/lite/apis/get_small_sharded_hf.py:41`

### Note: Secure Pattern…