NVD CRITICAL: CVE-2026-119706 — InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code e...

Friday, October 30, 2026 at 04:17 PM UTC·Source: NIST NVD

Updated: Friday, October 30, 2026 at 05:00 PM UTC

Executive Summary

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-119706

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Apple notifications alert victims in 99 countries about mercenary spyware infections

The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop .

1h agoCyberScoop

MEDIUMVulnerability

California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

Los Angeles County officials told CyberScoop they received multiple grand jury subpoenas investigating alleged election fraud. States and civil groups call it a federal power play. The post California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment appeared first on CyberScoop .

2h agoCyberScoop

MEDIUMVulnerability

Trezor warns of suspected crypto-theft implant in hardware wallet

Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. [...]

2h agoBleepingComputer