Vulnerability in lmdeploy (CVE-2026-33625)
Summary
Vulnerability in lmdeploy (CVE-2026-33625). Successful exploitation can lead to full system takeover. Exploitable via quantization_config.quant_dtype. Mitigation: upgrade to 0.12.3 or later.
Original description
The description as published by the source.
Summary
lmdeploy <= latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization_config.quant_dtype value. When a user loads the model with lmdeploy, the quant_dtype is passed to eval(f'torch.{quant_dtype}') without any validation.
Details
Vulnerable code (permalink):
quant_dtype = eval(f'torch.{quant_dtype}') # line 620
The quant_dtype value comes from the model's quantization_config in its HuggingFace config. When a model specifies quant_method: awq, the AWQ branch processes the config but does NOT override quant_dtype, allowing the malicious value to reach the eval() call.
Attack vector: An attacker publishes a HuggingFace model with:
{
"quantization_config": {
"quant_method": "awq",
"quant_dtype": "float16, __import__('os').system('id')"
}
}
Note: The _update_torch_dtype method at line 53 has a whitelist check, but that's for torch_dtype, NOT quant_dtype. The quant_dtype at line 620 has no validation whatsoever.
PoC
"""
PoC: eval() RCE in lmdeploy via malicious quant_dtype
Prerequisites: pip install lmdeploy
"""
import sys
from unittest.mock import MagicMock, patch
# Mock torch to capture the eval
sys.modules.setdefault('torch', Magic…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-33625 has been found in lmdeploy.
Attackers can target a specific entry point like quantization_config.quant_dtype over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 8.8/10.
What to do: upgrade lmdeploy to 0.12.3 or later.
If unsure, ask your IT team or search "lmdeploy CVE-2026-33625" on the vendor's site.
CVE-2026-33625 (lmdeploy) — CWE-400 / CVSS v3 8.8
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: quantization_config.quant_dtype / quant_dtype / quantization_config / _update_torch_dtype
Patched: 0.12.3 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in lmdeploy. Attackers reach the vulnerable code path via quantization_config.quant_dtype without authentication.
Check the vendor advisory for the affected versions of lmdeploy. Attack surface: quantization_config.quant_dtype / quant_dtype / quantization_config / _update_torch_dtype.
Severity: High (CVSS 8.8/10). Successful exploitation can lead to full system takeover.
Update to 0.12.3.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'lmdeploy' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'lmdeploy' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
lmdeployを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade lmdeploy to 0.12.3ステージング環境で 0.12.3 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- package pypi.org
- web github.com
- web github.com