What happened
LMDeploy, InternLM's toolkit for compressing, deploying, and serving LLMs, contained a code-injection vulnerability triggered simply by loading a specially crafted HuggingFace model repository, giving the model publisher arbitrary code execution on the serving host.
Why it matters
This is a classic AI supply-chain attack vector: any team that pulls community models from HuggingFace and serves them via LMDeploy is one malicious model download away from full host compromise, and the pattern recurs across LMDeploy releases (echoing earlier CVE-2025-3163 / CVE-2026-46432 trust_remote_code issues).
Attack vector
A code injection flaw in lmdeploy/pytorch/config.py allows an attacker who publishes a malicious HuggingFace model to execute arbitrary Python code on the machine of any operator who loads that model via LMDeploy — a recurrence of the trust_remote_code-style pattern that has affected LMDeploy previously.
Affected systems
LMDeploy 0.12.1 through 0.12.2
Mitigation
Upgrade to LMDeploy 0.12.3 or later.