PyPI/lmdeploy CVE-2025-66455: critical 9.8, EPSS 0.69%

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Action: Upgrade lmdeploy to 0.16.0 or later.

pip install lmdeploy==0.16.0

Affected

Fixed versions

Sources

• osv: GHSA-2vh9-42vm-xmv2
• https://github.com/InternLM/lmdeploy/security/advisories/GHSA-2vh9-42vm-xmv2
• https://github.com/InternLM/lmdeploy/commit/f05b4ad8bf2e2d84101a1d63b3c44fadd99223b2
• https://github.com/InternLM/lmdeploy
• https://github.com/InternLM/lmdeploy/releases/tag/v0.16.0

CVE-2025-66455 · published 2026-09-18T17:03:56Z · modified 2026-10-01T17:55:46.844524538Z · JSON