CVE-2026-46432: LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization

Synopsis

An arbitrary code execution vulnerability exists in LMDeploy (versions 0.12.3 and earlier) caused by the toolkit hardcoding trust_remote_code=True across multiple HuggingFace model-loading call sites. Any code embedded in a remote model repository is automatically executed without user consent or review when a model is loaded. An attacker who controls or compromises a model repository can achieve full code execution in the context of the loading process, giving them access to read secrets, modify files, or disrupt the service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the vulnerable service is required to trigger model loading.

• AuthenticationRequired

  A low-privilege local account is sufficient; any user able to invoke LMDeploy model-loading code can trigger execution of remote model code.

• Victim interactionNot required

  No victim interaction is needed; exploitation occurs automatically when LMDeploy loads a model from an attacker-controlled repository.

• Attack complexityDetail

  Attack complexity is low: exploitation is reliable and requires no race conditions, specific memory layout, or other environmental prerequisites beyond a malicious model repository being loaded.

Blast Radius

• Reads secrets, API keys, and environment variables accessible to the LMDeploy process.
• Writes or modifies files on disk within the permissions of the running process, including model weights, configuration files, and application code.
• Crashes or destabilizes the LMDeploy serving process, causing a denial of service for inference workloads depending on it.
• Pivots to other services or credentials reachable from the host if the process runs with broad network or filesystem access.