LLMHigh
CVE-2026-46517: LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.1…
- Occurred
- Jun 10, 2026
- Published
- Jun 10, 2026
- Source
- NVD CVE
Summary
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.
Tags
- CVE
- CVE-2026-46517
- cvss:HIGH
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: Hardcoded trust_remote_code in LLM toolkit enables supply-chain RCE, a significant security vulnerability.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8