LMDeploy patches three flaws including pickle-deserialization RCE over ZeroMQ in its disaggregated serving path

GitHub Advisory Database·medium signalXBlueskyLinkedInCopy link

Three advisories published 2026-09-18 hit LMDeploy, the inference server many self-hosted agent stacks sit on. The critical one, GHSA-2vh9-42vm-xmv2, is remote code execution via pickle deserialization in handle_zmq_recv in lmdeploy/pytorch/disagg/conn/engine_conn.py. The other two are a high-severity arbitrary code execution through eval() of an untrusted quant_dtype in model config loading (GHSA-3hmm-rh5q-gwwr) and an SSRF bypass (GHSA-39wr-7q6h-cf68). Read alongside this week's inference-engine fingerprinting paper, the pairing is the point: the engine underneath an agent is now both remotely attackable and identifiable from inside.