CVE-2026-46517

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46517", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-14T19:12:32.755Z", "datePublished": "2026-06-09T23:05:43.966Z", "dateUpdated": "2026-08-31T14:34:34.198Z"}, "containers": {"cna": {"title": "LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1188", "lang": "en", "description": "CWE-1188: Insecure Default Initialization of Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796"}, {"name": "https://github.com/github/advisory-database/pull/4511", "tags": ["x_refsource_MISC"], "url": "https://github.com/github/advisory-database/pull/4511"}, {"name": "https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107", "tags": ["x_refsource_MISC"], "url": "https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107"}, {"name": "https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py", "tags": ["x_refsource_MISC"], "url": "https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py"}, {"name": "https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0"}, {"name": "https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml", "tags": ["x_refsource_MISC"], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml"}], "affected": [{"vendor": "InternLM", "product": "lmdeploy", "versions": [{"version": "<= 0.12.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-31T14:34:34.198Z"}, "descriptions": [{"lang": "en", "value": "LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded \"trust_remote_code=True\" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue."}], "source": {"advisory": "GHSA-9xq9-36w5-q796", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T03:55:31.160135Z", "id": "CVE-2026-46517", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T10:18:19.271Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46517", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-11T03:55:31.160135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-10T15:16:15.247Z"}}], "cna": {"title": "LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out", "source": {"advisory": "GHSA-9xq9-36w5-q796", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "InternLM", "product": "lmdeploy", "versions": [{"status": "affected", "version": "<= 0.12.3"}]}], "references": [{"url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796", "name": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/github/advisory-database/pull/4511", "name": "https://github.com/github/advisory-database/pull/4511", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107", "name": "https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py", "name": "https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0", "name": "https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml", "name": "https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded \"trust_remote_code=True\" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-31T14:34:34.198Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46517", "state": "PUBLISHED", "dateUpdated": "2026-08-31T14:34:34.198Z", "dateReserved": "2026-05-14T19:12:32.755Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-09T23:05:43.966Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lmdeploy", "vendor": "InternLM", "versions": [{"status": "affected", "version": "<= 0.12.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded \"trust_remote_code=True\" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue."}, {"lang": "es", "value": "LMDeploy es un conjunto de herramientas para comprimir, desplegar y servir modelos de lenguaje grandes. En las versiones 0.12.3 y anteriores, el valor 'trust_remote_code=True' codificado de forma r\u00edgida permite RCE en la cadena de suministro de HF sin que el usuario lo autorice expl\u00edcitamente. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "id": "CVE-2026-46517", "lastModified": "2026-08-31T15:17:17.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46517", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T03:55:31.160135Z", "version": "2.0.3"}}]}, "published": "2026-06-10T00:16:53.827", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py"}, {"source": "security-advisories@github.com", "url": "https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107"}, {"source": "security-advisories@github.com", "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796"}, {"source": "security-advisories@github.com", "url": "https://github.com/github/advisory-database/pull/4511"}, {"source": "security-advisories@github.com", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-915"}, {"lang": "en", "value": "CWE-1188"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.12.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lmdeploy", "source": "cna", "vendor": "InternLM"}, "product": "lmdeploy", "vendor": "internlm"}], "created": "2026-06-10T00:30:17.082575+00:00", "updated": "2026-08-31T16:00:06.146071+00:00", "vendors": ["internlm", "internlm$PRODUCT$lmdeploy"]}