Threats tagged 'ghsa-fv7x-c662-7ccq'

LM Studio versions before 0.4.22+1 have a path traversal vulnerability in the model downloader's resolveDownloadRequest function. This flaw allows attackers to write files outside the intended models directory by using backslash-separated traversal filenames. Exploitation can lead to planting malicious files such as plugin manifest.json, install-state.json, and mcp-bridge-config.json, which execute an attacker-supplied Python payload on every application launch.