{"data":{"id":"8618886c-080e-4b70-b123-17f767cb39c9","title":"CVE-2025-67729: LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure…","summary":"CVE-2025-67729 affects LMDeploy, a toolkit for compressing, deploying, and serving LLMs, prior to version 0.11.1. The toolkit calls torch.load() without weights_only=True when loading model checkpoint files, which is an insecure deserialization flaw (CWE-502). Loading a malicious .bin or .pt model file lets an attacker execute arbitrary code on the victim's machine.","solution":"Fixed in 0.11.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67729","publishedAt":"2025-12-26T22:15:52.437Z","cveId":"CVE-2025-67729","cweIds":["CWE-502"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["lmdeploy@<= 0.11 (fixed: 0.11.1)"],"affectedPackageNames":["lmdeploy"],"affectedPackageRefs":["pypi:lmdeploy"],"affectedVendors":[],"affectedVendorsRaw":["LMDeploy"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LMDeploy insecure deserialization when loading model checkpoint files","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00508,"epssCheckedAt":"2026-11-04T12:08:33.950Z","kevDateAdded":null,"advisoryAliases":["GHSA-9pf3-7rrr-x5jh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:31.670Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-12-24T14:20:41.496Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:42:13.572Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"lmdeploy","fixedVersion":"0.11.1","matchedVersion":"0.11.1","fixReleasedAt":"2025-12-24T14:20:41.496Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:13.423Z"}]}}