Executive brief
lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
Affected products
- PyPI lmdeploy
Junglewise Threat Intelligence
CVE-2025-67729: PYSEC-2026-1578 - lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
CVE-2025-67729 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: lmdeploy (PyPI). Vendors: PyPI.
Related threats
- LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection
- LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0
- LMDeploy SSRF bypass in URL validation
- LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2
- PYSEC-2026-1579 - InternLM LMDeploy code injection vulnerability