CVE-2026-46517 Details

A remote code execution vulnerability has been identified in LMDeploy versions through 0.12.3. The issue arises from a hardcoded 'trust_remote_code=True' setting in the 'get_model_arch' function and related helpers. This default setting creates an implicit and unsafe remote code execution path by allowing models fetched from Hugging Face repositories to execute arbitrary Python code without user consent. The vulnerability exploits the user's trust in the repository, as they must manually input the model reference. When 'trust_remote_code=True' is applied, any malicious code in the repository's configuration files is executed as the LMDeploy process user, potentially leading to unauthorized access or data exfiltration.

Users can manually avoid this vulnerability by not loading third-party Hugging Face repositories with LMDeploy. However, this is not a practical solution, as it contradicts LMDeploy's intended use case. A proper fix would involve updating LMDeploy to allow users to opt-in to trusting remote code, similar to how other frameworks handle it.