CVE-2026-119979

LM Studio model downloads can plant startup code

LM Studio · LM Studio model downloader

First documented disclosure · Review checkpoint

Summary

A crafted model repository can write outside the model directory.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Public CNA disclosure; observed malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Backslash traversal in downloaded filenames can plant plugin configuration and a Python payload loaded at startup.

Conditions required

A user downloads an attacker-controlled model repository on an affected installation.

Potential impact

Persistent code execution with the application user’s privileges.

Affected versions and configurations

Before 0.4.22+1.

Fix and mitigation status

0.4.22 build 1 per VulnCheck.

Practical next steps

Install a current patched build; investigate unexpected plugin files and startup activity after suspicious downloads.

Operating lesson

Model downloads require canonical path checks before any file is written.

Evidence and limits

October 30 is the verified vulnerability disclosure. Vendor notes date build 1 to August 28 but do not describe this security fix; an earlier release is not itself an earlier flaw disclosure. The reviewed advisory does not define OS-specific scope.

Sources