Live › vulnerability › CVE-2026-119979
LM Studio before 0.4.22+1 fails to block backslash-separated path traversal in its model downloader, so a crafted model repository can write files outside the models directory. The planted plugin and MCP bridge config files cause an attacker-supplied Python payload to run every time LM Studio launches.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Anyone running LM Studio older than 0.4.22+1 who downloads models from third-party repositories is exposed, since the malicious model repository is the attack path. The sources do not say whether managed or shared installs differ from single-user desktop installs. Teams that only use models from trusted sources or have current builds can skip it.
No product ranges from the sources yet.
0.4.22+1 are in scope.manifest.json, install-state.json or mcp-bridge-config.json files in LM Studio's plugin directories and outside the models directory.0.4.22+1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
This page as .md · .json · in your agent: get_signal("CVE-2026-119979")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.