CVE-2025-67729: 
Python vulnerability analysis and mitigation

CVE-2025-67729 is an insecure deserialization vulnerability in InternLM's lmdeploy, an LLM deployment toolkit, that allows arbitrary code execution when loading malicious PyTorch model checkpoint files. The vulnerability affects all lmdeploy versions up to and including 0.11, with version 0.11.1 containing the fix. It was disclosed on December 26, 2025, via a GitHub Security Advisory (GHSA-9pf3-7rrr-x5jh). The CVSS v3.1 base score is 8.8 (High) (Github Advisory, Feedly).

The root cause is CWE-502 (Deserialization of Untrusted Data): multiple locations in lmdeploy call torch.load() without the weights_only=True parameter, which causes PyTorch to use Python's pickle module internally — a known-unsafe deserialization mechanism. Vulnerable files include lmdeploy/vl/model/utils.py (line 22), lmdeploy/turbomind/deploy/loader.py (line 122), lmdeploy/lite/apis/kv_qparams.py, lmdeploy/lite/apis/smooth_quant.py, lmdeploy/lite/apis/auto_awq.py, and lmdeploy/lite/apis/get_small_sharded_hf.py. An attacker crafts a malicious .bin or .pt file embedding a pickle payload with a __reduce__ method that executes arbitrary OS commands upon deserialization; exploitation requires the victim to load the file (user interaction). A PoC was published as part of the advisory demonstrating command execution via a crafted pytorch_model.bin (Github Advisory, Patch Commit).

Successful exploitation results in arbitrary code execution on the victim's machine with the privileges of the lmdeploy process, enabling full system compromise. An attacker can steal sensitive data (credentials, API keys, model weights), deploy malware such as cryptominers or ransomware, or pivot laterally to other systems in cloud or on-premises environments. All users who load PyTorch .bin or .pt model files from untrusted sources — including models downloaded from HuggingFace, ModelScope, or shared by third parties — are at risk (Github Advisory).

A proof-of-concept exploit was included in the security advisory itself, demonstrating RCE via a crafted pickle payload embedded in a pytorch_model.bin file. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.134% (33rd percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Craft a malicious checkpoint: Create a Python script that uses pickle to serialize a MaliciousPayload object whose __reduce__ method returns (os.system, ('malicious_command',)). Save the output as pytorch_model.bin or a .pt file.
2. Distribute the malicious model: Upload the file to a model-sharing platform (e.g., HuggingFace Hub, ModelScope) disguised as a legitimate fine-tuned model, or deliver it directly to the target via social engineering.
3. Victim loads the model: The victim uses lmdeploy to load the model (e.g., via lmdeploy.pipeline('path/to/malicious_model')), triggering one of the vulnerable torch.load() calls in lmdeploy/vl/model/utils.py, lmdeploy/turbomind/deploy/loader.py, or the lite/apis/ modules.
4. Code execution: During deserialization, pickle invokes __reduce__, executing the attacker's command with the victim's OS-level privileges — confirmed by the PoC output [PoC] Arbitrary code executed! - RCE confirmed.
5. Post-exploitation: The attacker can establish persistence, exfiltrate data, deploy additional payloads, or pivot to other systems accessible from the compromised host (Github Advisory).

• File System: Unexpected .bin or .pt files in model directories that are not from verified sources; presence of create_malicious_checkpoint.py or exploit.py scripts; new or modified files in the lmdeploy installation directory created by the service account.
• Process: Unusual child processes spawned by the Python/lmdeploy process (e.g., bash, sh, curl, wget, python) immediately after model loading; unexpected os.system() or subprocess calls in process trees.
• Network: Outbound connections to unknown external IPs or domains initiated by the lmdeploy process shortly after model file loading; unexpected data exfiltration traffic.
• Logs: Python tracebacks or warnings related to pickle deserialization in lmdeploy logs; unexpected command output appearing in application logs during model load operations (Github Advisory).

Upgrade lmdeploy to version 0.11.1 or later, which adds weights_only=True to all affected torch.load() calls across six files (Patch Commit). As an interim workaround, only load model checkpoints from verified, trusted sources and avoid loading .bin or .pt files from unknown third parties. Consider migrating to the SafeTensors format where possible, as it is already supported in lmdeploy and is immune to pickle-based deserialization attacks. Running lmdeploy in a sandboxed or isolated environment (e.g., container with restricted network and filesystem access) can limit the blast radius if exploitation occurs (Github Advisory).

The vulnerability was noted by TheHackerWire and shared on Mastodon and Bluesky shortly after disclosure, highlighting the risk of insecure deserialization in AI/ML tooling. Red Hat tracked the issue under their CVE database, and CISA included it in their weekly vulnerability bulletin (SB25-363) for the week of December 22, 2025. Community reaction emphasized the broader pattern of torch.load() misuse in ML frameworks, referencing related CVEs such as CVE-2025-32434 (PyTorch RCE, CVSS 9.3) and CVE-2024-5452 (PyTorch Lightning) as part of a recurring class of vulnerabilities in the AI/ML ecosystem (TheHackerWire, CISA Bulletin).