CVE-2026-119706

Summary

InternLM LMDeploy versions 0.9.0 through 0.18.0 contain an unauthenticated remote code execution (RCE) flaw in the /update_weights endpoint due to unsafe deserialization of pickled data via ForkingPickler.loads without validation, allowing attackers to execute arbitrary OS commands as the api_server process.

Exploitability

Exploitation is trivial for remote attackers since no authentication or user interaction is required and the vulnerable endpoint accepts base64-encoded malicious payloads directly.

Blast radius

Successful exploitation grants full system compromise of the host running the api_server, enabling data theft, service disruption, or lateral movement within the infrastructure.

Detection

Defenders should monitor for anomalous POST requests to /update_weights containing base64-encoded payloads with pickle-like signatures (e.g., 'B64:800495...' or 'B64:80027d...'), especially when accompanied by child process creation or unexpected network connections from the api_server process.

Prioritized remediation

Upgrade to LMDeploy version 0.19.0 or later, which addresses this vulnerability by validating and sanitizing serialized data before deserialization.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.