LMDeploy (0.9.0 Through 0.18.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/lmdeploy-0.9.0-through-0.18.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 17:36:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgInternLM LMDeploy: Unauthenticated remote code execution (CVE-2026-119706)https://feed.craftedsignal.io/briefs/2026-10-lmdeploy-rce/Fri, 30 Oct 2026 17:36:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-lmdeploy-rce/InternLM LMDeploy versions 0.9.0 through 0.18.0 are vulnerable to unauthenticated remote code execution via insecure deserialization of pickled data.<p>InternLM LMDeploy versions 0.9.0 through 0.18.0 contain an unauthenticated remote code execution vulnerability. Remote attackers can execute OS commands by sending a base64-encoded crafted pickle to the '/update_weights' endpoint within the 'serialized_named_tensors' parameter. The application's use of 'ForkingPickler.loads' to deserialize this input without validation allows for command execution as the api_server process.</p> criticaladvisory