CVE-2026-107204
criticalLMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to…
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/LMCache/LMCache disclosure@vulncheck.com
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/run_s... disclosure@vulncheck.com
- https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/common_ap... disclosure@vulncheck.com
- https://github.com/LMCache/LMCache/issues/5510 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/lmcache-through-0.5.5-unauthenticated-rce-via-run-scr... disclosure@vulncheck.com
- https://github.com/LMCache/LMCache/issues/5510 134c704f-9b21-4f2e-91b3-4a467353bcc0