CVE-2025-59953

LMdeploy's AsyncRPCServer (zmq_rpc.py) passes incoming RPC messages directly to pickle.loads() without any sanitization (CWE-502), so anyone who can send a request to the server's TCP endpoint can have it deserialize attacker-controlled pickle data. Because pickle deserialization can instantiate arbitrary objects, an attacker reaching the RPC port gains arbitrary code execution on the host; the researcher demonstrated a full reverse shell from a crafted request. The server performs no validation of the connecting IP, and although its port is randomized, an attacker can find it by port scanning, so any network-reachable deployment is at risk. Affected users are operators running lmdeploy's RPC server component (typically in distributed/multi-node LLM inference setups), especially where the service is reachable beyond localhost or from untrusted networks. No exploitation in the wild is known and the flaw is not in CISA KEV, though the advisory includes working reproduction steps, and the flaw carries a CVSS 3.1 score of 9.8 (critical).

What to do: No patched version is identified in the advisory, so monitor the lmdeploy repository/PyPI for a fix and upgrade as soon as one is released; the maintainer-suggested mitigations are replacing pickle with a safer serializer (e.g., msgpack or safetensors) or restricting deserialization via an Unpickler.find_class allowlist, plus enabling RPC authentication. In the meantime, bind the RPC server to localhost or a trusted, firewalled cluster network only, and audit hosts for lmdeploy RPC processes listening on non-local ports.