Executive brief
LMdeploy is a framework for deploying large language models that includes an RPC server for inter-process communication. The RPC server deserializes untrusted network messages using Python's pickle module without validation, allowing attackers to execute arbitrary code on machines running the service. Prior to version 0.10.2, the RPC server was exposed on the network interface; even after the fix that binds to localhost, local processes can still be exploited.
Technical details
The vulnerability is an unsafe deserialization flaw in AsyncRPCServer's call_and_response() method in zmq_rpc.py. The server deserializes ZMQ RPC messages directly using pickle.loads() without any input validation or whitelist controls. In versions 0.9.1–0.10.1, the RPC server bound to tcp://* on a network interface with a randomized port, allowing any network-reachable attacker to craft a malicious pickle payload and trigger remote code execution. An attacker can enumerate ports or brute-force the RPC endpoint, send a crafted pickle object that executes shell commands during deserialization, and gain full command-line access. Version 0.10.2 mitigates the remote network attack surface by binding to localhost only, but the underlying pickle deserialization vulnerability remains and can be exploited by untrusted local processes.
Affected products
- InterLM LMdeploy 0.9.1 to 0.10.1
Timeline
- 2025-09-16: disclosed: GHSA-5h8j-6crg-7rmw published
- 2025-10-02: patched: Version 0.10.2 released; RPC server binding changed from tcp://* to localhost