{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet · updates",
  "home_page_url": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706",
  "feed_url": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706/feed.json",
  "description": "InternLM LMDeploy, an open-source toolkit for serving large language models, has an unauthenticated remote code execution flaw in its api_server (CVE-2026-119706, CVSS 4.0 9.3 / CVSS 3.1 9.8 critical). Versions 0.9.0 through 0.18.0 deserialize a base64-encoded pickle sent in serialized_named_tensors to the POST /update_weights endpoint with ForkingPickler.loads and no validation, so anyone who can reach the server can run OS commands as the api_server process. The bug was reported publicly in GitHub issue #4698 in June 2026; the fix pull request #4964, which makes the HTTP endpoint reject pickle by default, is still open and not in any release. The fix PR notes that the default api_server binds to 0.0.0.0 without API keys.",
  "language": "en",
  "_pwn": {
    "slug": "lmdeploy-update-weights-pickle-rce-cve-2026-119706",
    "severity": "critical",
    "status": "live",
    "patchStatus": "unpatched",
    "rss": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706/feed.xml",
    "llms": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706/llms.txt",
    "json": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706#2026-10-30-4073c8ad",
      "url": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706#2026-10-30-4073c8ad",
      "title": "LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet: VulnCheck publishes CVE-2026-119706 (CVSS 4.0 9.3 critical): unauthenticated RCE in LMDeploy 0.9.0 through 0.18.0 via pickle in /update_weights. The fix PR #4964 (reject pickle on HTTP /update_weights by default) is still open, so no release contains the fix.",
      "content_text": "LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet: VulnCheck publishes CVE-2026-119706 (CVSS 4.0 9.3 critical): unauthenticated RCE in LMDeploy 0.9.0 through 0.18.0 via pickle in /update_weights. The fix PR #4964 (reject pickle on HTTP /update_weights by default) is still open, so no release contains the fix.\n\nSource: https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://www.vulncheck.com/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706#2026-06-22-ee9ee9b4",
      "url": "https://pwn.watch/i/lmdeploy-update-weights-pickle-rce-cve-2026-119706#2026-06-22-ee9ee9b4",
      "title": "LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet: A GitHub issue reports that LMDeploy /update_weights deserializes request-controlled pickle data before validation.",
      "content_text": "LMDeploy unauthenticated RCE via pickle in /update_weights (CVE-2026-119706), no fixed release yet: A GitHub issue reports that LMDeploy /update_weights deserializes request-controlled pickle data before validation.\n\nSource: https://github.com/InternLM/lmdeploy/issues/4698",
      "date_published": "2026-06-22T00:00:00.000Z",
      "external_url": "https://github.com/InternLM/lmdeploy/issues/4698",
      "tags": [
        "critical"
      ]
    }
  ]
}