{"action":"Upgrade lmdeploy to 0.13.0 or later.","affected":[{"fixed":"0.13.0","introduced":"0"}],"component":"lmdeploy","cve_ids":["CVE-2026-46517"],"ecosystem":"PyPI","epss":0.00163,"exploited":false,"fixed_versions":["0.13.0"],"ghsa_id":"GHSA-9xq9-36w5-q796","id":"tcs_01M5KFBWX68B99XEHH7RNDAFHB","modified_at":"2026-09-15T05:15:04.426947029Z","published_at":"2026-05-21T19:33:32Z","references":["https://osv.dev/vulnerability/GHSA-9xq9-36w5-q796","https://github.com/InternLM/lmdeploy/security/advisories/GHSA-9xq9-36w5-q796","https://nvd.nist.gov/vuln/detail/CVE-2026-46517","https://github.com/github/advisory-database/pull/4511","https://github.com/InternLM/lmdeploy/commit/81be52961aa324fd5cd3cacebffba1ba051bc107","https://github.com/InternLM/lmdeploy","https://github.com/InternLM/lmdeploy/blob/v0.13.0/lmdeploy/version.py","https://github.com/InternLM/lmdeploy/releases/tag/v0.13.0","https://github.com/pypa/advisory-database/tree/main/vulns/lmdeploy/PYSEC-2026-2608.yaml"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-9xq9-36w5-q796","url":"https://osv.dev/vulnerability/GHSA-9xq9-36w5-q796"}],"summary":"lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out"}