CVE-2026-46517: LMDeploy Supply-Chain RCE Vulnerability

CVE-2026-46517 Overview

CVE-2026-46517 affects LMDeploy, a toolkit for compressing, deploying, and serving large language models (LLMs). Versions 0.12.3 and prior hardcode trust_remote_code=True when loading models from Hugging Face (HF). This setting causes LMDeploy to execute arbitrary Python code embedded in remote model repositories without user opt-in. An attacker who publishes or compromises a model on the HF Hub can achieve remote code execution (RCE) on any host that loads the model through LMDeploy. The flaw is classified under [CWE-94] (Improper Control of Generation of Code). At time of publication, no patches are available.

Critical Impact
Loading any Hugging Face model through LMDeploy silently executes attacker-controlled Python code, enabling full host compromise via the model supply chain.

Affected Products

LMDeploy versions 0.12.3 and prior
InternLM LMDeploy toolkit deployments serving Hugging Face models
Downstream applications and services embedding LMDeploy for LLM inference

Discovery Timeline

2026-06-10 - CVE-2026-46517 published to the National Vulnerability Database (NVD)
2026-06-11 - Record last updated in NVD database

Technical Details for CVE-2026-46517

Vulnerability Analysis

LMDeploy integrates with the Hugging Face Transformers loader to fetch and instantiate model architectures. The Transformers library exposes a trust_remote_code parameter that controls whether custom Python modules shipped inside a model repository are imported and executed. When set to True, the loader runs arbitrary code from modeling_*.py, configuration_*.py, and tokenization_*.py files distributed with the model.

LMDeploy hardcodes this parameter to True in its model loading paths. Users who pass a model identifier to LMDeploy cannot opt out of remote code execution through configuration. The behavior bypasses the explicit consent mechanism Hugging Face built into the Transformers API.

Root Cause

The root cause is improper control of generated code [CWE-94] combined with an insecure default that cannot be overridden by the caller. By forcing trust_remote_code=True, LMDeploy treats every remote repository as trusted execution context. Any attacker who controls a model repository, compromises a maintainer account, or performs a typosquatting attack on the HF Hub can deliver a Python payload that runs with the privileges of the LMDeploy process.

Attack Vector

Exploitation follows the supply-chain pattern. An attacker publishes a malicious model or compromises an existing repository on Hugging Face. A victim runs LMDeploy and references the model identifier through the command-line interface, the Python API, or a serving endpoint. LMDeploy downloads the repository and invokes the embedded Python modules during model instantiation. The attacker's code executes in-process before any inference request is served. Exploitation requires user interaction in the form of selecting or specifying the malicious model. Successful exploitation yields code execution with confidentiality, integrity, and availability impact on the host.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-9xq9-36w5-q796 for the upstream technical description.

Detection Methods for CVE-2026-46517

Indicators of Compromise

Unexpected child processes spawned by lmdeploy, python, or model server processes immediately after model load
Outbound network connections from inference hosts to non-Hugging Face domains during or shortly after model download
New or modified Python files under the Hugging Face cache directory, typically ~/.cache/huggingface/modules/transformers_modules/
Execution of modeling_*.py, configuration_*.py, or tokenization_*.py files originating from untrusted model repositories

Detection Strategies

Audit installed LMDeploy versions across inference infrastructure and flag any instance at version 0.12.3 or earlier
Inspect LMDeploy invocations and library calls for hardcoded trust_remote_code=True parameters in wrapper code
Correlate model load events with subsequent process execution, file writes outside the model cache, and outbound connections

Monitoring Recommendations

Log every model identifier loaded by LMDeploy and compare against an allowlist of vetted repositories and pinned commit hashes
Monitor the Hugging Face cache directory for newly written Python modules and alert on execution of those modules
Capture process lineage from LLM serving containers to identify command execution chains originating from inference workloads

How to Mitigate CVE-2026-46517

Immediate Actions Required

Restrict LMDeploy hosts to loading only internally vetted models pinned to specific commit revisions on Hugging Face
Run LMDeploy inside isolated containers or sandboxes with no outbound internet access to arbitrary domains and minimal filesystem privileges
Remove or disable LMDeploy-based services that accept user-supplied model identifiers from untrusted sources
Inventory all LMDeploy deployments and identify upstream applications that pass model paths into the toolkit

Patch Information

At the time of publication, no upstream patch is available from the LMDeploy maintainers. Track the GitHub Security Advisory GHSA-9xq9-36w5-q796 for fix availability. Until a patched release is published, treat all LMDeploy installations at version 0.12.3 and prior as exposed.

Workarounds

Patch the local LMDeploy installation to remove hardcoded trust_remote_code=True and require explicit opt-in from operators
Pre-download and validate model repositories offline, then load them from local paths rather than HF Hub identifiers
Apply egress filtering on inference hosts to block downloads from arbitrary Hugging Face repositories outside an approved list
Enforce least-privilege service accounts so that any code executed during model load cannot reach sensitive secrets or production data

bash

# Configuration example: run LMDeploy in a restricted container with a pinned, locally cached model
docker run --rm \
  --network=none \
  --read-only \
  --tmpfs /tmp \
  -v /opt/models/vetted-model:/models/vetted-model:ro \
  --user 10001:10001 \
  --cap-drop=ALL \
  lmdeploy:pinned \
  lmdeploy serve api_server /models/vetted-model