CVE-2026-119706 json
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
published 10d ago modified 7d ago also EUVD-2026-114111
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.
Patch / fix
- github.com/InternLM/lmdeploy#4964 pull request
Is CVE-2026-119706 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10d ago
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/InternLM/lmdeploy/issues/4698 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- InternLM lmdeploy
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/InternLM/lmdeploy/pull/4964
patch, issue-tracking
-
github.com
/InternLM/lmdeploy/issues/4698
issue-tracking, exploit
-
github.com
/InternLM/lmdeploy
product
-
github.com
/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/serve/openai/endpoints/management.py#L55-L60
technical-description
-
github.com
/InternLM/lmdeploy/blob/v0.18.0/lmdeploy/turbomind/turbomind.py#L345
technical-description
-
vulncheck.com
/advisories/lmdeploy-0.9.0-through-0.18.0-unauthenticated-rce-via-update-weights-pickle-deserialization
third-party-advisory
Sources
- CVE List CVE-2026-119706
- NVD CVE-2026-119706
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.