lmdeploy vulnerabilities (PyPI)
10 vulnerabilities.
-
lmdeployPyPI LMDeploy has an SSRF bypass 7.5 High -
lmdeployPyPI LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading 8.8 High -
lmdeployPyPI LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py 9.8 Critical -
lmdeployPyPI LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy 9.8 Critical -
lmdeployPyPI LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out 7.8 High -
lmdeployPyPI LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization 7.8 High -
lmdeployPyPI LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading 7.5 High -
lmdeployPyPI lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load() 8.8 High -
lmdeployPyPI InternLM LMDeploy conf.py open code injection 4.8 Medium -
lmdeployPyPI InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization 4.8 Medium