CVE-2026-46432: LMDeploy RCE Vulnerability

CVE-2026-46432 Overview

CVE-2026-46432 is an arbitrary code execution vulnerability in LMDeploy, a toolkit for compressing, deploying, and serving large language models (LLMs). The flaw affects versions 0.12.3 and prior. LMDeploy hardcodes trust_remote_code=True across multiple HuggingFace model-loading call sites. This forces execution of arbitrary Python code embedded in model repositories without user consent. The weakness is classified under [CWE-94] (Improper Control of Generation of Code). No patches are available at the time of publication.

Critical Impact
An attacker who controls a HuggingFace model repository loaded by LMDeploy can execute arbitrary code in the context of the serving process, leading to full compromise of the host running the inference service.

Affected Products

LMDeploy (InternLM) versions 0.12.3 and prior
Deployments using LMDeploy to serve HuggingFace-hosted models
Inference services and pipelines built on top of LMDeploy model loaders

Discovery Timeline

2026-06-10 - CVE-2026-46432 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46432

Vulnerability Analysis

LMDeploy loads models from HuggingFace using transformers APIs such as AutoModel.from_pretrained and AutoTokenizer.from_pretrained. These APIs accept a trust_remote_code parameter. When this flag is set to True, the transformers library imports and executes arbitrary Python code shipped inside the model repository. LMDeploy hardcodes this flag to True at multiple call sites. Users cannot disable it through configuration. Any model loaded by LMDeploy therefore executes attacker-controlled Python during initialization.

The impact extends across confidentiality, integrity, and availability. Code runs with the privileges of the LMDeploy process, which often holds access to GPU resources, model weights, API keys, and adjacent services.

Root Cause

The root cause is insecure default configuration combined with code injection exposure (CWE-94). The maintainers chose convenience over safety by hardcoding trust_remote_code=True rather than exposing a user-controlled switch that defaults to False. There is no allowlist of trusted repositories and no signature verification on remote code.

Attack Vector

Exploitation requires that LMDeploy load a model from a repository under the attacker's control or a repository the attacker has tampered with. Typical scenarios include the following. An operator pulls a malicious community model from HuggingFace Hub. A supply-chain attacker compromises a legitimate model namespace and pushes a backdoored revision. An internal user with low privileges supplies a model identifier to a multi-tenant LMDeploy service. Once from_pretrained is invoked, the embedded modeling_*.py file executes immediately on the host.

The attack vector is local because the attacker must influence model selection or supply the malicious artifact through an existing trust boundary.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-m549-qq94-fvhg for technical details.

Detection Methods for CVE-2026-46432

Indicators of Compromise

Unexpected child processes spawned by the LMDeploy Python interpreter during or shortly after model load
Outbound network connections from the inference host to unknown domains immediately after from_pretrained calls
New or modified files under the HuggingFace cache directory (~/.cache/huggingface/) containing modeling_*.py or configuration_*.py with executable logic beyond class definitions
GPU or inference processes reading sensitive files such as ~/.ssh/, cloud credential stores, or environment dumps

Detection Strategies

Audit LMDeploy source and deployments for hardcoded trust_remote_code=True references in model-loading call sites
Inventory all HuggingFace model identifiers loaded in production and verify their provenance against an internal allowlist
Inspect HuggingFace cache directories for repositories that ship custom *.py files alongside weights
Enable Python audit hooks (sys.addaudithook) to log import, exec, and compile events around model load

Monitoring Recommendations

Forward process creation, file integrity, and network telemetry from inference hosts to a centralized analytics platform
Alert on Python processes that execute os.system, subprocess.Popen, or socket.connect within seconds of model loading
Monitor egress from GPU nodes, which typically should not initiate arbitrary outbound traffic
Track changes to HuggingFace repository revisions pinned by production services

How to Mitigate CVE-2026-46432

Immediate Actions Required

Restrict LMDeploy deployments to load only models from an internal, vetted mirror of HuggingFace repositories
Remove or fork LMDeploy 0.12.3 and patch the hardcoded trust_remote_code=True to False where remote code is not required
Run LMDeploy processes under a dedicated low-privilege account with no access to credentials, secrets, or unrelated services
Isolate inference hosts with strict egress filtering to block unexpected outbound connections

Patch Information

No official patch is available at the time of publication. Track the InternLM LMDeploy security advisory GHSA-m549-qq94-fvhg for updates. Until a fix lands, apply the workarounds below.

Workarounds

Maintain an internal allowlist of model repository identifiers and pin specific commit revisions rather than tracking branches
Pre-download and inspect model repositories in a sandbox before promoting them to production caches, removing any unexpected *.py files
Patch LMDeploy locally to expose trust_remote_code as a user-controlled argument that defaults to False
Run LMDeploy inside a container with read-only filesystems, dropped capabilities, seccomp profiles, and no outbound network access except to known model registries

bash

# Example: run LMDeploy in a hardened container with no outbound network
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=none \
  -v /opt/models:/models:ro \
  lmdeploy:0.12.3 \
  lmdeploy serve api_server /models/vetted-model