HIGHCVSS 7.8EPSS 0.2%

CVE-2026-46517

CVE-2026-46517 updated by NVD

Published: 2026-05-21
Modified: 2026-09-02
EPSS percentile: 6%
Sources: github-advisory, nvd

Summary

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	lmdeploy	—	0.13.0

Remediation: Upgrade to 0.13.0 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46517

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.