Vendor
LMDeploy versions 0.9.1 through 0.10.1 are vulnerable to remote code execution due to insecure pickle deserialization within the AsyncRPCServer component, allowing attackers to execute arbitrary system commands.