GHSA-m549-qq94-fvhg: LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

Summary

lmdeploy hardcodes trust_remote_code=True at several HuggingFace Transformers call sites in lmdeploy/archs.py and lmdeploy/utils.py, including AutoConfig.from_pretrained(), PretrainedConfig.get_config_dict() and GenerationConfig.from_pretrained(). Versions lmdeploy <= 0.12.3 are confirmed affected, verified on v0.12.3 and main. An attacker who controls the model_path of a serving process can point it to a malicious HuggingFace repository, and Transformers then executes its remote Python code with the serving process's privileges.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• MediumCVE-2026-100653: vLLM unpinned Hugging Face artifact loads for FunAudioChat and Tarsier2Same vendor · NVD/CVE Database
• HighGHSA-3hmm-rh5q-gwwr: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingSame vendor · Hugging Face Security Advisories
• MediumCVE-2026-80047: Hugging Face Transformers writes remote Python files to disk before trust checkSame vendor · NVD/CVE Database
• HighCVE-2026-58474: whichllm code injection in run and snippet commands via GGUF filenamesSame vendor · NVD/CVE Database
• HighCVE-2026-79784: Vocos class instantiation from configuration via from_pretrainedSame vendor · NVD/CVE Database