📦 Lmdeploy

LMDeploy versions before 0.11.1 have an insecure deserialization vulnerability where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows att...

This critical vulnerability in InternLM LMDeploy allows code injection through manipulation of the Open function in the configuration file. Attackers can execute arbitrary code on affected systems, po...