CVE-2025-67729
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-502
Deserialización de datos no confiables
Fecha de publicación:
26/12/2025
Última modificación:
26/12/2025
Descripción
*** Pendiente de traducción *** LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious .bin or .pt model file. This issue has been patched in version 0.11.1.
Impacto
Puntuación base 3.x
8.80
Gravedad 3.x
ALTA