{"id":"CVE-2026-119979","kind":"vulnerability","aliases":["CVE-2026-119979"],"related":[],"title":"LM Studio: crafted model download writes files and runs attacker Python on launch","description":"LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.","summary":"LM Studio before 0.4.22+1 fails to block backslash-separated path traversal in its model downloader, so a crafted model repository can write files outside the models directory. The planted plugin and MCP bridge config files cause an attacker-supplied Python payload to run every time LM Studio launches.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","developer-desktop","lm-studio","local-llm"],"not_affected_if":["trusted-model-sources-only","version-0.4.22+1-or-later"],"how_to_check":"- Check the installed LM Studio version in the app's About screen or package metadata; versions below `0.4.22+1` are in scope.\n- Look for unexpected `manifest.json`, `install-state.json` or `mcp-bridge-config.json` files in LM Studio's plugin directories and outside the models directory.","fix":"- LM Studio: move to `0.4.22+1` or later.","status":"open","published_at":"2026-10-30T18:17:27+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","triaged_at":"2026-10-30T18:56:30+00:00","updated_at":"2026-10-30T18:56:30+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-30T18:56:30Z","model":"claude-haiku-5-5","output":{"fix":"- LM Studio: move to `0.4.22+1` or later.","reach":"local","title":"LM Studio: crafted model download writes files and runs attacker Python on launch","impact":"high","summary":"LM Studio before 0.4.22+1 fails to block backslash-separated path traversal in its model downloader, so a crafted model repository can write files outside the models directory. The planted plugin and MCP bridge config files cause an attacker-supplied Python payload to run every time LM Studio launches.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["lm-studio","local-llm","developer-desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker Python code runs on every LM Studio launch","analyst_note":"Confirm the affected version range and whether the vendor advisory lists a fixed build beyond 0.4.22+1; the NVD entry is the only source given.","how_to_check":"- Check the installed LM Studio version in the app's About screen or package metadata; versions below `0.4.22+1` are in scope.\n- Look for unexpected `manifest.json`, `install-state.json` or `mcp-bridge-config.json` files in LM Studio's plugin directories and outside the models directory.\n- unknown for any further check the sources do not describe.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.4.22+1-or-later","trusted-model-sources-only"],"who_is_affected":"Anyone running LM Studio older than 0.4.22+1 who downloads models from third-party repositories is exposed, since the malicious model repository is the attack path. The sources do not say whether managed or shared installs differ from single-user desktop installs. Teams that only use models from trusted sources or have current builds can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4173,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'+1':36B,87C '-119979':16A,19A '-2026':15A,18A '0.4.22':35B,86C 'ai':21B 'ai-tool':20B 'allow':100C 'attack':10A,72B,101C,115C,136C 'attacker-suppli':71B,135C 'backslash':41B,111C 'backslash-separ':40B,110C 'block':39B 'bridg':66B 'caus':69B 'config':67B 'contain':88C 'craft':3A,51B,122C 'cve':14A,17A 'desktop':25B 'develop':24B 'developer-desktop':23B 'directori':60B,108C 'download':5A,48B,96C,120C 'everi':78B,141C 'fail':37B 'file':7A,56B,68B,104C 'filenam':114C 'install-state.json':130C 'launch':13A,82B,142C 'llm':31B 'lm':1A,27B,32B,80B,83C 'lm-studio':26B 'local':30B 'local-llm':29B 'manifest.json':129C 'mcp':65B 'mcp-bridge-config.json':132C 'model':4A,47B,52B,59B,95C,107C,123C 'outsid':57B,105C 'path':43B,90C 'payload':75B,139C 'plant':62B,126C 'plugin':63B,128C 'python':11A,74B,138C 'repositori':53B,124C 'resolvedownloadrequest':98C 'run':9A,77B,133C 'separ':42B,112C 'studio':2A,28B,33B,81B,84C 'suppli':73B,137C 'time':79B 'tool':22B 'travers':44B,91C,113C 'trick':117C 'use':109C 'user':118C 'vulner':92C 'write':6A,55B,103C","nicknames":[],"mitigations":[],"who_affected":"Anyone running LM Studio older than 0.4.22+1 who downloads models from third-party repositories is exposed, since the malicious model repository is the attack path. The sources do not say whether managed or shared installs differ from single-user desktop installs. Teams that only use models from trusted sources or have current builds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119979","severity":null,"published_at":"2026-10-30T18:17:27+00:00","modified_at":"2026-10-30T18:17:27+00:00","first_seen_at":"2026-10-30T18:55:30+00:00","fetched_at":"2026-10-30T18:55:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}