-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lmdeploy | pip | <= 0.7.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is clearly described in multiple sources (GitHub issue, CVE, VulDB) as being in the load_weight_ckpt function in lmdeploy/lmdeploy/vl/model/utils.py. The function's vulnerability stems from its unsafe use of torch.load() without proper input validation or security parameters. This is a direct input processing function that handles checkpoint files, and the exploit demonstration shows how malicious .pt files can trigger arbitrary code execution through this function. Since all sources consistently point to this single function as the vulnerability point, and the exploit path is clearly demonstrated, the confidence in this identification is high.