CVE-2026-46432: LMDeploy Arbitrary Code Execution via Hardcoded Remote Code Trust

Technical summary

CVE-2026-46432 exploits CWE-94 (Improper Control of Generation of Code) by hardcoding trust_remote_code=True across multiple HuggingFace model-loading call sites in LMDeploy. The HuggingFace transformers library uses this flag to determine whether to deserialize and execute custom code objects stored in model configurations or pickled weights. By default, this flag should be False to prevent untrusted model files from executing arbitrary code. LMDeploy's unconditional enablement of this flag eliminates the user's ability to make a security decision and creates an implicit chain of trust from LMDeploy to any model accessible via HuggingFace, including community-contributed models. An attacker positioning a malicious model on HuggingFace or intercepting model downloads can achieve remote code execution in the context of the LMDeploy process.

Business impact

Organizations using LMDeploy to deploy and serve large language models face direct risk of compromise through model supply-chain attacks. A malicious or compromised model can execute code with the privileges of the LMDeploy service, potentially leading to data exfiltration, lateral movement, model tampering, or service disruption. For teams using LMDeploy in production inference pipelines, this vulnerability allows an attacker to gain a foothold on the deployment infrastructure without requiring authentication or exploiting additional vulnerabilities. The impact scales with deployment scale—compromising a shared LMDeploy service affects all downstream applications consuming that service.

Affected systems

LMDeploy versions 0.12.3 and prior are vulnerable. Any deployment or development environment running these versions is at risk when loading models from HuggingFace or other remote sources. The vulnerability is particularly acute in shared deployment environments where multiple users or services rely on the same LMDeploy instance, as well as in CI/CD pipelines that automatically fetch and serve new models without human review.

Exploitability

This vulnerability requires local or network access to invoke LMDeploy's model-loading functions. An attacker must either have direct access to the system running LMDeploy (local exploitation) or be able to influence which model gets loaded (supply-chain or MITM vector). The attack does not require user interaction or special privileges beyond the ability to trigger a model load operation. Because many LMDeploy deployments load models automatically on startup or via API calls, the barrier to exploitation is low once an attacker can influence model selection or compromise the HuggingFace account hosting a model.

Remediation

Immediately cease use of LMDeploy 0.12.3 and prior in environments where remote model loading is enabled or where model sources are not fully controlled. Monitor the LMDeploy project for patched versions that disable trust_remote_code by default or require explicit, logged user approval. Until patches are available, restrict model loading to locally vetted and audited model files, implement strict network segmentation to prevent unauthorized model downloads, and enforce code review of any custom model configurations before deployment.

Patch guidance

At the time of publication (2026-06-17), no public patches are available. Security teams should subscribe to LMDeploy's release notes and security advisories for patch availability. When a patched version is released, verify that it explicitly disables trust_remote_code by default in all HuggingFace model-loading call sites and requires explicit user configuration to enable code execution from remote models. Test patches in a staging environment before production deployment to ensure they do not break existing model-loading workflows.

Detection guidance

Audit LMDeploy process execution and logging to identify model load operations, particularly those involving remote or community-contributed models from HuggingFace. Monitor for unexpected child processes or network connections spawned by LMDeploy services following model load events. Check deployment configurations and scripts for hardcoded references to models on HuggingFace and review which versions of LMDeploy are deployed across your environment. Network-level detection should flag attempts to download models from unexpected HuggingFace accounts or unusual model sources.

Why prioritize this

This vulnerability merits high priority because it affects the integrity and confidentiality of machine learning inference infrastructure, enables supply-chain attack vectors, and lacks public patches. The CVSS 7.8 score reflects the combination of local/network attack surface, high impact (code execution with process privileges), and the critical role LMDeploy plays in production AI systems. Organizations with LMDeploy in production should prioritize mitigation or version upgrades as patches become available.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a low attack complexity (simple model load operation), low privilege requirement (user running LMDeploy), and high impact across confidentiality, integrity, and availability. The attack vector is listed as local (AV:L), but in cloud and containerized deployments, this can extend to network scope. The scoring appropriately captures the severity of arbitrary code execution in a critical infrastructure component, balanced against the requirement for some level of access to trigger the vulnerable code path.

Frequently asked questions