{"data":{"id":"08fd75d2-191c-4743-a432-fbec9992b9e2","title":"GHSA-2vh9-42vm-xmv2: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py","summary":"LMDeploy's PyTorch DistServe control plane deserialized ZeroMQ messages with recv_pyobj(), which uses pickle and can execute arbitrary code during deserialization. An attacker who can reach the POST /distserve/p2p_connect endpoint can point the server at a malicious ZeroMQ peer, and deployments without API-key authentication allow unauthenticated remote code execution with the privileges of the serving process. Affected versions are lmdeploy >= 0.9.2, < 0.16.0, and only when PD-disaggregation/DistServe is enabled.","solution":"Fixed in LMDeploy 0.16.0, which replaces pickle-based ZeroMQ messaging with JSON (send_json()/recv_json()) and validates received objects against the DistServeCacheFreeRequest Pydantic schema. Interim workarounds: prevent untrusted clients from reaching /distserve/* endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. The source states these workarounds reduce exposure but do not make pickle deserialization safe.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2vh9-42vm-xmv2","publishedAt":"2026-09-18T17:03:56.000Z","cveId":"CVE-2025-66455","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["lmdeploy@>= 0.9.2, < 0.16.0 (fixed: 0.16.0)"],"affectedPackageNames":["lmdeploy"],"affectedPackageRefs":["pypi:lmdeploy"],"affectedVendors":[],"affectedVendorsRaw":["LMDeploy"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01266,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":["GHSA-2vh9-42vm-xmv2"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-18T17:03:56.000Z","fixReleasedAt":"2026-08-19T06:41:11.499Z","daysToFix":-30,"fixCheckedAt":"2026-10-29T21:30:29.133Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"lmdeploy","fixedVersion":"0.16.0","matchedVersion":"0.16.0","fixReleasedAt":"2026-08-19T06:41:11.499Z","daysToFix":-30,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:28.988Z"}]}}