LLMHigh
CVE-2026-46432: LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.1…
- Occurred
- Jun 10, 2026
- Published
- Jun 10, 2026
- Source
- NVD CVE
Summary
LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no publicly available patches.
Tags
- CVE
- CVE-2026-46432
- cvss:HIGH
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: CVE describes arbitrary code execution vulnerability in LLM deployment toolkit, posing significant security risk.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8