CVE-2026-119979LM Studio before 0.4.22+1 Path Traversal via Model Downloader

Beschreibung

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• LM Studio 0.4.22 Release Notes release-notes
• VulnCheck Advisory: LM Studio before 0.4.22+1 Path Traversal via Model Downloader third-party-advisory