{"action":"Upgrade lmcache to 0.5.6 or later.","affected":[{"fixed":"0.5.6","introduced":"0.3.9"}],"component":"lmcache","cve_ids":["CVE-2026-105192"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.5.6"],"ghsa_id":"GHSA-w5f2-9q9c-ff4h","id":"tcs_01M5JHHW3D33A1DNCFNXKDART8","modified_at":"2026-10-16T20:15:03.732682699Z","published_at":"2026-10-16T20:08:44Z","references":["https://osv.dev/vulnerability/GHSA-w5f2-9q9c-ff4h","https://github.com/LMCache/LMCache/security/advisories/GHSA-w5f2-9q9c-ff4h","https://nvd.nist.gov/vuln/detail/CVE-2026-105192","https://github.com/LMCache/LMCache/pull/5644","https://github.com/LMCache/LMCache/pull/5684","https://github.com/LMCache/LMCache/pull/5685","https://github.com/LMCache/LMCache/commit/160b6dec469edb765efd1fad42aca5a438b08bb5","https://github.com/LMCache/LMCache/commit/62f74c417dfe1ba56761733fd25dc8209a192f20","https://github.com/LMCache/LMCache/commit/767c7e367bbdc357c445cf7bd2ed259cff8d5865","https://blog.lmcache.ai/en/2026/10/13/an-update-on-cve-2026-105192","https://github.com/LMCache/LMCache","https://github.com/LMCache/LMCache/blob/v0.3.9/lmcache/v1/multiprocess/custom_types.py","https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/platform/base/ipc_wrapper.py","https://research.jfrog.com/vulnerabilities/lmcache-is-vulnerable-to-unauthenticated-remote-code-execution-via-pickle-deserialization-on-the-multiprocess-zmq-transport-cve-2026-105192-jfsa-2026-001694382"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-w5f2-9q9c-ff4h","url":"https://osv.dev/vulnerability/GHSA-w5f2-9q9c-ff4h"}],"summary":"LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport"}