HIGH 8.7 NVD
CVE-2026-119979
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
References
- https://lmstudio.ai/changelog/lmstudio-v0.4.22
- https://www.vulncheck.com/advisories/lm-studio-before-0.4.22-1-path-traversal-via-model-do
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.