Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-107204

LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: poc
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.

Affected versions

  • LMCache LMCache

    through 0.5.5

References 5

GitHub · LMCache/LMCache

vulncheck.com