Lmdeploy (0.9.1 - 0.10.1)

LMDeploy versions 0.9.1 through 0.10.1 are vulnerable to remote code execution due to insecure pickle deserialization within the AsyncRPCServer component, allowing attackers to execute arbitrary system commands.