lmdeploy Remote Code Execution Vulnerability: Early Warning
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- HIGH
- Affected component
- lmdeploy (pypi)
- Affected versions
- <= 0.12.2 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.11.1, <= 0.11.1 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.12.2, <= 0.12.2 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or <= 0.7.1 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or < 0.11.1 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or < 0.13.0 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.11.1, <= 0.11.1 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.12.2, <= 0.12.2 or >= 0.12.3, <= 0.12.3 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or <= 0.7.1 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or < 0.13.0 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.11.1, <= 0.11.1 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.12.2, <= 0.12.2 or >= 0.12.3, <= 0.12.3 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or <= 0.7.1 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or < 0.11.1 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or <= 0.7.1 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or <= 0.12.2 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.11.1, <= 0.11.1 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.12.2, <= 0.12.2 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or <= 0.12.3 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.11.1, <= 0.11.1 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.12.2, <= 0.12.2 or >= 0.12.3, <= 0.12.3 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1 or < 0.13.0 or >= 0.0.10, <= 0.0.10 or >= 0.0.11, <= 0.0.11 or >= 0.0.12, <= 0.0.12 or >= 0.0.13, <= 0.0.13 or >= 0.0.14, <= 0.0.14 or >= 0.1.0, <= 0.1.0 or >= 0.10.0, <= 0.10.0 or >= 0.10.1, <= 0.10.1 or >= 0.10.2, <= 0.10.2 or >= 0.11.0, <= 0.11.0 or >= 0.11.1, <= 0.11.1 or >= 0.12.0, <= 0.12.0 or >= 0.12.1, <= 0.12.1 or >= 0.12.2, <= 0.12.2 or >= 0.12.3, <= 0.12.3 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.3, <= 0.2.3 or >= 0.2.4, <= 0.2.4 or >= 0.2.5, <= 0.2.5 or >= 0.2.6, <= 0.2.6 or >= 0.3.0, <= 0.3.0 or >= 0.4.0, <= 0.4.0 or >= 0.4.1, <= 0.4.1 or >= 0.4.2, <= 0.4.2 or >= 0.5.0, <= 0.5.0 or >= 0.5.1, <= 0.5.1 or >= 0.5.2, <= 0.5.2 or >= 0.5.2.post1, <= 0.5.2.post1 or >= 0.5.3, <= 0.5.3 or >= 0.6.0, <= 0.6.0 or >= 0.6.0a0, <= 0.6.0a0 or >= 0.6.1, <= 0.6.1 or >= 0.6.2, <= 0.6.2 or >= 0.6.2.post1, <= 0.6.2.post1 or >= 0.6.3, <= 0.6.3 or >= 0.6.4, <= 0.6.4 or >= 0.6.5, <= 0.6.5 or >= 0.7.0, <= 0.7.0 or >= 0.7.0.post1, <= 0.7.0.post1 or >= 0.7.0.post2, <= 0.7.0.post2 or >= 0.7.0.post3, <= 0.7.0.post3 or >= 0.7.1, <= 0.7.1 or >= 0.7.2, <= 0.7.2 or >= 0.7.2.post1, <= 0.7.2.post1 or >= 0.7.3, <= 0.7.3 or >= 0.8.0, <= 0.8.0 or >= 0.9.0, <= 0.9.0 or >= 0.9.1, <= 0.9.1 or >= 0.9.2, <= 0.9.2 or >= 0.9.2.post1, <= 0.9.2.post1
- Patched version
- Not yet available
GHSA-5H8J-6CRG-7RMW
An early warning has been issued for a remote code execution vulnerability in the lmdeploy package. The vulnerability arises from unsafe deserialization of received messages in the RPC server implementation.
What happened
The lmdeploy package, available on PyPI, has been identified as vulnerable to a remote code execution attack. This vulnerability is due to the package's RPC server directly deserializing received messages without proper sanitization. An attacker could exploit this by sending maliciously crafted messages to the RPC server, potentially leading to arbitrary code execution on the server.
The vulnerability affects a wide range of lmdeploy versions, as detailed in the threat data. It is crucial for users to review the specific version ranges provided in the threat data to determine if their installations are at risk.
What to do about it
- Monitor the provided sources for updates on a patched version of lmdeploy.
- Review and audit any custom RPC communications within your systems for similar vulnerabilities.
- Consider implementing additional security measures to sanitize and validate incoming RPC messages until a patched version is available.
- Stay informed about the latest security advisories and updates related to lmdeploy.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
lmdeploy is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using any version of lmdeploy within the specified vulnerable ranges as detailed in the threat data.
What should I do right now?
Monitor the sources for updates on a patched version and review your custom RPC communications for vulnerabilities.
Has this been exploited in the wild?
There is no confirmed evidence of this vulnerability being exploited in the wild at this time.