CVE-2026-46517: LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

High severity · published Jun 9, 2026

CVE-2026-46517

LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

7.8

CVSS

0.2%

EPSS

On KEV

Description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 5% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

lmdeploy · InternLM

<= 0.12.3 · source: vendor

Affected product

lmdeploy

InternLM

All lmdeploy CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-46517

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-46517

github.com

https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py

github.com

https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107

github.com

https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0

github.com

https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796

github.com

https://github.com/github/advisory-database/pull/4511

github.com

https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml