AIKIDO-2026-414862
lmdeploy is vulnerable to Deserialization of Untrusted Data
93
Critical Risk
This Affects:
lmdeployTL;DR
The disaggregated-serving peer connector's handle_zmq_recv path reads peer messages with recv_pyobj(), which deserializes bytes via pickle.loads() before any type check against DistServeCacheFreeRequest. Callers can set remote_engine_endpoint_info.zmq_address through unauthenticated POST /distserve/p2p_initialize and /distserve/p2p_connect when api_keys is unset, so an attacker can make an engine pull attacker-controlled ZMQ payloads and execute arbitrary code in the engine process. The fix serializes those peer requests as JSON instead of pickle.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and enable disaggregated serving.
Background info
lmdeploy is vulnerable to Deserialization of Untrusted Data in versions 0.9.2 - 0.15.0.
How to fix this
Upgrade the lmdeploy library to the patch version.
Links
GitHub Release
Related Issue
Other
github.com/InternLM/lmdeploygithub.com/InternLM/lmdeploy/blob/v0.15.0/lmdeploy/pytorch/disagg/conn/engine_conn.py#L61github.com/InternLM/lmdeploy/blob/v0.15.0/lmdeploy/pytorch/disagg/conn/engine_conn.py#L79
vulncheck.com/advisories/lmdeploy-remote-code-execution-via-unsafe-pickle-deserialization-in-the-disaggregated-serving-peer-connector
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant