Three LMDeploy advisories land at once, topped by a 9.8 unauthenticated pickle RCE in the DistServe control plane
GitHub published three LMDeploy advisories on 2026-09-18. CVE-2025-66455 (GHSA-2vh9-42vm-xmv2, CVSS 9.8) lets anyone who can reach a DistServe API server POST to /distserve/p2p_connect, make the server dial an attacker-controlled ZeroMQ endpoint, and get arbitrary code execution through recv_pyobj's pickle deserialization, with no API key required because auth is off by default. CVE-2026-33625 (8.8) is a one-line eval(f'torch.{quant_dtype}') in lmdeploy/pytorch/config.py:620 that turns publishing a HuggingFace model with a crafted quantization_config into RCE on every machine that loads it. A third advisory covers an SSRF filter bypass. If you self-host inference behind an agent stack, the supply-chain path here is loading a model, not calling one.
↳ Follow the thread