https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 14:34:04 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46517 <p><strong>Affected:</strong> InternLM lmdeploy</p> <p>LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded &#34;trust_remote_code=True&#34; enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.</p> <p><strong>Affected:</strong> InternLM lmdeploy</p> <p>LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded &#34;trust_remote_code=True&#34; enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-46517 https://cve.radiocsirt.org/vuln/ghsa-9xq9-36w5-q796 <p><strong>Affected:</strong> PyPI: lmdeploy</p> <p>&gt; ## 📋 Reframing (2026-05-02): implicit unsafe remote-code path, not &#34;supply-chain&#34; &gt; &gt; The accurate description of this vulnerability is: &gt; **&#34;`get_model_arch` and related helpers hardcode `trust_remote_code=True` &gt; with no opt-out, creating an implicit unsafe remote-code load path &gt; on every model fetch.&#34;** &gt; &gt; What this report does NOT claim: &gt; * It is NOT a network-attack RCE — the user supplies the model &gt; reference; LMDeploy honors it. &gt; * It is NOT a &#34;supply chain&#34; CVE in the classical sense (where a &gt; benign upstream is compromised) — the user explicitly types the &gt; repo name. &gt; &gt; What this report DOES claim: &gt; * Other inference frameworks (vLLM, TGI, Hugging Face transformers &gt; itself) all expose `--trust-remote-code` as **opt-in** so that &gt; users who consciously load known-safe repos can opt in, while &gt; users following a tutorial cannot accidentally execute attacker &gt; Python by typing a wrong repo name. &gt; * LMDeploy&#39;s hardcoded True is an **implicit** trust-boundary &gt; override that violates HF Transformers&#39; default-secure stance &gt; (`trust_remote_code=False` since transformers ≥ 4.30). &gt; * The fix is a one-line CLI flag (`--trust-remote-code`) defaulting &gt; False, threaded through the three sites, matching the rest of &gt; the ecosystem. &gt; &gt; Severity should be assessed as **hardening / safe-by-default**, &gt; not as full unauthenticated RCE. CVSS revised to **5.5 Medium** &gt; (`AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` × user-must-load qualifier). &gt; &gt; Runtim…</p> <p><strong>Affected:</strong> PyPI: lmdeploy</p> <p>&gt; ## 📋 Reframing (2026-05-02): implicit unsafe remote-code path, not &#34;supply-chain&#34; &gt; &gt; The accurate description of this vulnerability is: &gt; **&#34;`get_model_arch` and related helpers hardcode `trust_remote_code=True` &gt; with no opt-out, creating an implicit unsafe remote-code load path &gt; on every model fetch.&#34;** &gt; &gt; What this report does NOT claim: &gt; * It is NOT a network-attack RCE — the user supplies the model &gt; reference; LMDeploy honors it. &gt; * It is NOT a &#34;supply chain&#34; CVE in the classical sense (where a &gt; benign upstream is compromised) — the user explicitly types the &gt; repo name. &gt; &gt; What this report DOES claim: &gt; * Other inference frameworks (vLLM, TGI, Hugging Face transformers &gt; itself) all expose `--trust-remote-code` as **opt-in** so that &gt; users who consciously load known-safe repos can opt in, while &gt; users following a tutorial cannot accidentally execute attacker &gt; Python by typing a wrong repo name. &gt; * LMDeploy&#39;s hardcoded True is an **implicit** trust-boundary &gt; override that violates HF Transformers&#39; default-secure stance &gt; (`trust_remote_code=False` since transformers ≥ 4.30). &gt; * The fix is a one-line CLI flag (`--trust-remote-code`) defaulting &gt; False, threaded through the three sites, matching the rest of &gt; the ecosystem. &gt; &gt; Severity should be assessed as **hardening / safe-by-default**, &gt; not as full unauthenticated RCE. CVSS revised to **5.5 Medium** &gt; (`AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` × user-must-load qualifier). &gt; &gt; Runtim…</p> https://cve.radiocsirt.org/vuln/ghsa-9xq9-36w5-q796