Executive brief
LMDeploy is an inference serving framework that supports distributed deployments through its DistServe feature. An unauthenticated attacker with network access to the DistServe HTTP API can trigger the serving process to deserialize untrusted pickle objects from a remote ZeroMQ endpoint, leading to arbitrary code execution with the privileges of the serving process. This exposes model weights, credentials, and cluster resources.
Technical details
LMDeploy's DistServe control plane uses PyZMQ's `recv_pyobj()` method to deserialize messages from ZeroMQ PULL sockets. The vulnerable code path is triggered via the `POST /distserve/p2p_connect` HTTP endpoint, which accepts an attacker-controlled ZeroMQ peer address in `DistServeConnectionRequest.remote_engine_endpoint_info.zmq_address`. When the LMDeploy engine connects to this address and calls `handle_zmq_recv()` in `engine_conn.py`, Python's pickle deserialization executes arbitrary code embedded in the crafted payload before any type validation occurs. API-key authentication is disabled by default, allowing unauthenticated exploitation. The vulnerability was fixed in LMDeploy 0.16.0 by replacing pickle-based serialization with JSON and adding Pydantic schema validation.
Affected products
- InternLM LMDeploy 0.9.2 to 0.15.x
Timeline
- 2026-09-18: disclosed: GHSA-2vh9-42vm-xmv2 published
- 2026: patched: Fixed in LMDeploy 0.16.0 via commit f05b4ad8