SZB-16ec9f3a2f
EUVD lists unauthenticated RCE in InternLM LMDeploy 0.9.0 through 0.18.0 (EUVD-2026-114111)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- InternLM
- Product
- LMDeploy
- First seen
Summary
The EUVD listing says LMDeploy 0.9.0 through 0.18.0 has an unauthenticated remote code execution flaw via pickled data sent to the /update_weights endpoint. It gives a CVSS v3.1 score of 9.3/10 and was last updated 2026-10-30.
If you use InternLM
Upgrade LMDeploy beyond 0.18.0 once the vendor confirms a fixed release
Block external access to the /update_weights endpoint now
Check logs for unexpected requests to /update_weights
What the sources say 1
· Mastodon: “InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint.” Source