Is CVE-2026-33625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33625 being exploited in the wild.

How severe is CVE-2026-33625?

High severity, with a CVSS score of 8.8, published 18 September 2026.

Which products and versions are affected?

lmdeploy (PyPI) >= 0.12.1, < 0.12.3, ECOSYSTEM:introduced=0.12.1,fixed=0.12.3.

Is there a fix for CVE-2026-33625?

Yes. lmdeploy (PyPI): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33625 attacked?

It is attacked over the network.

Am I affected by CVE-2026-33625?

Check whether you run lmdeploy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33625: LMDeploy arbitrary code execution via eval() of untrusted quant_dtype

Q: Is there a fix for CVE-2026-33625?

Yes. lmdeploy (PyPI): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33625 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-33625?

Check whether you run lmdeploy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33625 · Severity: high · CVSS 8.8 · Published 2026-09-18

LMDeploy is a toolkit for deploying large language models. An attacker can trigger remote code execution by publishing a malicious model on HuggingFace Hub that contains a crafted quantization config. When a user loads the model with LMDeploy, arbitrary Python code embedded in the config is executed with the user's privileges, enabling full system compromise.

Technologies: lmdeploy (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-33625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33625 being exploited in the wild.
How severe is CVE-2026-33625?: High severity, with a CVSS score of 8.8, published 18 September 2026.
Which products and versions are affected?: lmdeploy (PyPI) >= 0.12.1, < 0.12.3, ECOSYSTEM:introduced=0.12.1,fixed=0.12.3.
Is there a fix for CVE-2026-33625?: Yes. lmdeploy (PyPI): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33625 attacked?: It is attacked over the network.
Am I affected by CVE-2026-33625?: Check whether you run lmdeploy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lmdeploy (PyPI): upgrade to 0.12.3 or later
```
pip install "lmdeploy>=0.12.3"
```

Technical details

The vulnerability is a code injection flaw in lmdeploy/pytorch/config.py line 620, where the quant_dtype parameter from a model's quantization_config is passed directly to eval(f'torch.{quant_dtype}') without validation. The quant_dtype value originates from a HuggingFace model's configuration file and is not sanitized, even though a similar torch_dtype parameter has a whitelist check. An attacker can craft a model with a quant_dtype value containing arbitrary Python code (e.g., "float16, __import__('os').system('id')"). The attack requires only that a user loads the malicious model via LMDeploy's standard APIs; no user interaction beyond that is needed, making this a supply-chain attack vector.

Affected products

InternLM LMDeploy all versions up to and including latest

Identifiers

CVE-2026-33625
GHSA-3hmm-rh5q-gwwr
PYSEC-2026-4078

Timeline

2026-09-18: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.