GHSA-2vh9-42vm-xmv2: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Summary

LMDeploy's PyTorch DistServe control plane deserialized ZeroMQ messages with recv_pyobj(), which uses pickle and can execute arbitrary code during deserialization. An attacker who can reach the POST /distserve/p2p_connect endpoint can point the server at a malicious ZeroMQ peer, and deployments without API-key authentication allow unauthenticated remote code execution with the privileges of the serving process. Affected versions are lmdeploy >= 0.9.2, < 0.16.0, and only when PD-disaggregation/DistServe is enabled.

Mitigation

Fixed in LMDeploy 0.16.0, which replaces pickle-based ZeroMQ messaging with JSON (send_json()/recv_json()) and validates received objects against the DistServeCacheFreeRequest Pydantic schema. Interim workarounds: prevent untrusted clients from reaching /distserve/* endpoints, restrict the DistServe HTTP and ZeroMQ control planes to trusted cluster networks, configure API-key authentication, and block arbitrary outbound ZeroMQ connections from serving nodes. The source states these workarounds reduce exposure but do not make pickle deserialization safe.

Topics

• Model and package supply chain

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online