AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-2vh9-42vm-xmv2: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

criticalvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseSeptember 18, 2026CVE-2025-66455

Summary

LMDeploy versions 0.9.2 through 0.15.x have a remote code execution vulnerability in their DistServe feature, which uses pickle deserialization (a Python method that can accidentally run malicious code while unpacking data) on messages from untrusted ZeroMQ sockets. An attacker who can send requests to the `/distserve/p2p_connect` endpoint can trick the server into connecting to a malicious endpoint and executing arbitrary code with the privileges of the LMDeploy process, especially if API-key authentication is not enabled.

Solution / Mitigation

Upgrade to LMDeploy version 0.16.0 or later, which fixes the issue by replacing pickle deserialization with JSON serialization and validating received objects using the `DistServeCacheFreeRequest` Pydantic schema. If immediate upgrade is not possible, the source recommends these temporary mitigations: prevent untrusted clients from reaching `/distserve/*` endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes (though these measures do not make pickle deserialization safe).