LM Studio model downloader path traversal lets a crafted model run code on every launch (CVE-2026-119979), fixed in 0.4.22+1

LM Studio, the desktop app for running large language models locally, has a path traversal flaw in its model downloader (CVE-2026-119979, CVSS 4.0 8.7 high). Before 0.4.22+1, resolveDownloadRequest accepted backslash-separated traversal filenames, so a crafted model repository could write files outside the models directory. VulnCheck says an attacker who tricks a user into downloading such a model can plant a plugin manifest.json, install-state.json and mcp-bridge-config.json that run an attacker-supplied Python payload every time LM Studio launches. The bug was credited to Ariel Fogel of Pillar Security and is fixed in LM Studio 0.4.22+1.

Why this severity: CVSS 4.0 8.7 and CVSS 3.1 8.8 (network, no privileges, needs the user to download a crafted model); results in persistent code execution on every launch

Started

Oct 30, 2026

CVE

CVE-2026-119979

• #LM Studio
• #Llm
• #Local Ai
• #Desktop App
• #Path Traversal
• RCE
• #Malicious Model