Threats affecting pkg:github/internlm/lmdeploy

CVE-2026-92983 is a high-severity vulnerability in InternLM lmdeploy versions up to 0.17.0. The issue occurs in DistServe prefill/decode disaggregation mode where scheduler sessions are not properly released due to the proxy using user-facing session IDs instead of internal scheduler keys. This allows unauthenticated attackers to send completion requests that cause unreleased scheduler metadata and memory accumulation, potentially leading to out-of-memory termination of the prefill worker.

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthenticated attackers to terminate the inference engine. Attackers can submit a migration_request with an empty remote_block_ids list to trigger an AssertionError that crashes the engine loop and causes subsequent inference requests to fail.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

LMDeploy versions prior to 0.12.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the vision-language module. The vulnerability arises because the load_image() function fetches arbitrary URLs without validating whether the addresses are internal or private. This flaw allows attackers to potentially access internal network resources, including cloud metadata services. The issue is fixed in version 0.12.3.