CVE-2026-46517: LMDeploy Supply-Chain RCE via Hardcoded Trust Settings

Technical summary

CVE-2026-46517 stems from hardcoded `trust_remote_code=True` in LMDeploy's code-loading pipeline. The vulnerability permits arbitrary remote code execution (RCE) when LMDeploy loads models or dependencies from Hugging Face Hub without cryptographic verification or user consent. The issue affects the supply chain at the point where untrusted serialized model artifacts are deserialized and executed. This is not a typical network-based attack surface; rather, it represents a silent privilege escalation path for attackers who can compromise upstream artifacts on Hugging Face or intercept model downloads.

Business impact

Organizations using LMDeploy to deploy or serve LLMs face supply-chain compromise risk. A successful attack could lead to unauthorized code execution with the privileges of the LMDeploy process, potentially compromising model inference servers, training pipelines, or downstream applications that depend on LMDeploy outputs. For teams running LMDeploy in containerized or cloud environments, this could facilitate lateral movement, data exfiltration, or persistence. The lack of an available patch means vulnerable deployments remain at risk until mitigation or version upgrades are possible.

Affected systems

All installations of LMDeploy version 0.12.3 and prior are affected. Users who rely on LMDeploy to load models from Hugging Face Hub, or who integrate LMDeploy into CI/CD pipelines for model serving, are at highest risk. The vulnerability does not require network exposure; local or container-based deployments are vulnerable if they fetch remote models.

Exploitability

Exploitation requires either: (1) compromise of a Hugging Face repository or model card that a target organization uses, or (2) man-in-the-middle interception of model downloads. While the latter is unlikely on HTTPS, the former is plausible in supply-chain scenarios where models are publicly shared, dependencies are third-party, or access controls on Hugging Face accounts are weak. The attack is not trivial in its execution but is high-impact once successful; user interaction is required only in the sense that an administrator must invoke LMDeploy to load a compromised artifact.

Remediation

Users should immediately upgrade LMDeploy to a version later than 0.12.3 when patches become available. Until then, mitigations include: (1) restricting Hugging Face model sources to internally vetted or self-hosted repositories, (2) disabling direct internet access from LMDeploy processes and performing offline model caching, (3) running LMDeploy in least-privilege containers with minimal filesystem and network permissions, and (4) auditing all model and dependency sources for integrity using checksums or cryptographic signatures where available.

Patch guidance

At time of publication, no patches have been released. Monitor LMDeploy's official GitHub repository and release notes for version updates beyond 0.12.3. When a patch is available, prioritize immediate deployment in development and staging environments to verify compatibility before rolling out to production inference servers. Consider establishing a process to pin LMDeploy versions and require security review before upgrades to catch any potential breakages.

Detection guidance

Monitor LMDeploy process executions for unexpected child processes or network connections that deviate from normal model-loading behavior. Log all model downloads from Hugging Face, including URLs, timestamps, and file hashes. Use endpoint detection and response (EDR) tools to flag any unusual behavior in LMDeploy runtime contexts. Additionally, audit Hugging Face account access logs and model repository history to detect unauthorized modifications. Implement Software Bill of Materials (SBOM) scanning to track LMDeploy versions across your infrastructure.

Why prioritize this

This vulnerability merits high priority despite lack of in-the-wild exploitation because: (1) the attack surface is the software supply chain, where a single compromise can affect many downstream users; (2) the absence of patches creates an extended window of exposure; (3) organizations may not even be aware they are running vulnerable versions; and (4) the user-interaction requirement is minimal—simply loading a model triggers the flaw. Teams deploying LLMs in regulated or high-security environments should treat this as urgent.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects high impact (confidentiality, integrity, and availability all affected) and local attack vector. The score does not fully capture supply-chain risk or the fact that no patches exist; however, the underlying technical severity is significant. Organizations should consider this a baseline and adjust upward if they rely heavily on Hugging Face models or maintain public-facing LLM services.

Frequently asked questions