# LM Studio model downloader path traversal lets a crafted model run code on every launch (CVE-2026-119979), fixed in 0.4.22+1 · pwn.watch

> LM Studio, the desktop app for running large language models locally, has a path traversal flaw in its model downloader (CVE-2026-119979, CVSS 4.0 8.7 high). Before 0.4.22+1, resolveDownloadRequest accepted backslash-separated traversal filenames, so a crafted model repository could write files outside the models directory. VulnCheck says an attacker who tricks a user into downloading such a model can plant a plugin manifest.json, install-state.json and mcp-bridge-config.json that run an attacker-supplied Python payload every time LM Studio launches. The bug was credited to Ariel Fogel of Pillar Security and is fixed in LM Studio 0.4.22+1.

Page: https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979 · generated 2026-10-30T21:12:50.286Z

## Status
- Severity: high · status: live · patch: patched
- Product: LM Studio (desktop app, model downloader)
- Started: 2026-10-30
- CVEs: CVE-2026-119979
- Affected: LM Studio before 0.4.22+1
- Fixed in: LM Studio 0.4.22+1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979/feed.xml
- JSON Feed: https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979.json
- This file: https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979/llms.txt

## Updates (newest first)
- 2026-10-30: VulnCheck publishes CVE-2026-119979 (CVSS 4.0 8.7 high): path traversal in LM Studio's model downloader before 0.4.22+1 lets a crafted model repository plant plugin files that run attacker Python code on every launch. Credit: Ariel Fogel of Pillar Security. (https://www.vulncheck.com/advisories/lm-studio-before-0.4.22-1-path-traversal-via-model-downloader)

## Fix brief
# Security brief: LM Studio model downloader path traversal lets a crafted model run code on every launch (CVE-2026-119979), fixed in 0.4.22+1

Source: https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979 · status: live · severity: high · updated Oct 30, 2026, 18:27 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
LM Studio, the desktop app for running large language models locally, has a path traversal flaw in its model downloader (CVE-2026-119979, CVSS 4.0 8.7 high). Before 0.4.22+1, resolveDownloadRequest accepted backslash-separated traversal filenames, so a crafted model repository could write files outside the models directory. VulnCheck says an attacker who tricks a user into downloading such a model can plant a plugin manifest.json, install-state.json and mcp-bridge-config.json that run an attacker-supplied Python payload every time LM Studio launches. The bug was credited to Ariel Fogel of Pillar Security and is fixed in LM Studio 0.4.22+1.

Severity detail: CVSS 4.0 8.7 and CVSS 3.1 8.8 (network, no privileges, needs the user to download a crafted model); results in persistent code execution on every launch

- Product: LM Studio (desktop app, model downloader)
- CVE / advisory ids: CVE-2026-119979

## Affected versions
- LM Studio before 0.4.22+1

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- LM Studio 0.4.22+1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Update LM Studio to 0.4.22+1 or later (in-app updater or lmstudio.ai). Only download models from publishers you trust. If you downloaded models from unknown repositories on an older version, check LM Studio's plugin and extension folders for plugins you did not install (look for unexpected manifest.json, install-state.json or mcp-bridge-config.json files) and remove them.

## Latest updates
- Oct 30, 2026: VulnCheck publishes CVE-2026-119979 (CVSS 4.0 8.7 high): path traversal in LM Studio's model downloader before 0.4.22+1 lets a crafted model repository plant plugin files that run attacker Python code on every launch. Credit: Ariel Fogel of Pillar Security.

## Advisories
- [LM Studio before 0.4.22+1 Path Traversal via Model Downloader](https://www.vulncheck.com/advisories/lm-studio-before-0.4.22-1-path-traversal-via-model-downloader) (VulnCheck)
- [CVE-2026-119979](https://nvd.nist.gov/vuln/detail/CVE-2026-119979) (NVD)

## Write-ups & news
- [LM Studio 0.4.22 release notes](https://lmstudio.ai/changelog/lmstudio-v0.4.22)

---
Machine-readable: https://pwn.watch/i/lm-studio-model-downloader-path-traversal-cve-2026-119979.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.