CVE-2026-119979
HIGH
MEDIUM
Priority: 0.00
BB Relevance:
67/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Element Labs | LM Studio | 0 < 0.4.22+1 |
| Element Labs | LM Studio | 0 < 0.4.22+1 |
References & Advisories (2)
third-party-advisory
release-notes