Project and affected component
Model configuration and initialization paths in LMDeploy.
Security boundary
A model reference crosses from deployment configuration into Python code loading inside the inference process.
Vulnerability class
CWE-1188 insecure default with CWE-94 code-execution consequences.
Root cause
Multiple model-loading paths hardcoded trust_remote_code=True. A user could not keep the safer Hugging Face default while loading a model through those paths.
Validation method
Source review mapped each forced trust flag to model initialization, a controlled model repository confirmed code execution, peer behavior separated the LMDeploy default from normal Transformers behavior, and a matched control kept remote code disabled.
Practical impact
Loading an untrusted or substituted model repository could execute Python with the privileges and data access of the inference process.
Disclosure status
InternLM published GHSA-9xq9-36w5-q796 and assigned CVE-2026-46517. GitHub lists ibondarenko1 as the reporter.
Remediation
Make remote code an explicit operator choice, default it to false, pass the decision through every model-loading path, and surface a clear warning when it is enabled.