PyPIPackage

lmdeploy

9 known vulnerabilities (2 critical, 5 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 0.18.0 (Sep 28, 2026): no advisory affects it
Newest unaffected release: 0.18.0 (Sep 28, 2026), the latest release
Advisories: 9 · 2 critical, 5 high, 2 medium

Weekly downloads: 13.7K
Dependents: 1
Releases: 58 since 0.0.10 (Sep 26, 2023)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-33625
Affects 0.12.1 to 0.12.2 (0.12.3 is outside it)
CVE-2025-66455
Affects 0.9.2 to 0.15.0 (0.16.0 is outside it)
CVE-2025-59953
Affects 0.9.1 to 0.10.1 (0.10.2 is outside it)
CVE-2026-46517
Affects 0.0.10 to 0.12.3 (0.13.0 is outside it)
CVE-2026-46432
Affects 0.0.10 to 0.12.3 (0.13.0 is outside it)
CVE-2026-33626
Affects 0.0.10 to 0.12.2 (0.12.3 is outside it)
CVE-2025-67729
Affects 0.0.10 to 0.11.0 (0.11.1 is outside it)
CVE-2025-3163
Affects 0.0.10 to 0.7.1 (0.7.2 is outside it)
CVE-2025-3162
Affects 0.0.10 to 0.7.1 (0.7.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-33625High 8.8
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
Affected: from 0.12.1, fixed in 0.12.3.
Fixed in 0.12.3 (released Apr 22, 2026, 149 days before disclosure).
The latest release, 0.18.0, is not affected.
CVE-2025-66455Critical 9.8
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
Affected: from 0.9.2, fixed in 0.16.0.
Fixed in 0.16.0 (released Aug 19, 2026, 30 days before disclosure).
The latest release, 0.18.0, is not affected.
CVE-2025-59953Critical 9.8
LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy
Affected: from 0.9.1, fixed in 0.10.2.
Fixed in 0.10.2 (released Oct 28, 2025, 323 days before disclosure).
The latest release, 0.18.0, is not affected.
CVE-2026-46517High 7.8
LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
Affected: through 0.12.3; fixed in 0.13.0.
Fixed in 0.13.0 (released May 12, 2026, 28 days before disclosure).
The latest release, 0.18.0, is not affected.
CVE-2026-46432High 7.8
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
Affected: fixed in 0.13.0.
Fixed in 0.13.0 (released May 12, 2026, 28 days before disclosure).
The latest release, 0.18.0, is not affected.
CVE-2026-33626High 7.5
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
Affected: through 0.12.2.
Fixed in 0.12.3 (released Apr 22, 2026, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.18.0, is not affected.
CVE-2025-67729High 8.8
lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
Affected: fixed in 0.11.1.
Fixed in 0.11.1 (released Dec 24, 2025, 2 days before disclosure).
The latest release, 0.18.0, is not affected.
CVE-2025-3163Medium 4.8
InternLM LMDeploy conf.py open code injection
Affected: through 0.7.1.
Fixed in 0.7.2 (released Mar 19, 2025, 15 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.18.0, is not affected.
CVE-2025-3162Medium 4.8
InternLM LMDeploy PT File utils.py load_weight_ckpt deserialization
Affected: through 0.7.1.
Fixed in 0.7.2 (released Mar 19, 2025, 15 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.18.0, is not affected.