CVE-2026-119979 in LM Studio
Summary
by MITRE • 10/30/2026
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in LM Studio versions prior to 0.4.22+1 represents a critical path traversal flaw within the application's model downloading mechanism. Specifically, the resolveDownloadRequest function fails to adequately sanitize or validate file paths provided during the download process. This lack of rigorous input validation allows an attacker to manipulate directory navigation sequences using backslash-separated characters, which are interpreted by the underlying operating system as valid path separators on Windows environments. By constructing a malicious model repository with filenames containing these traversal sequences, an adversary can bypass intended sandboxing constraints that restrict file writes to the designated models directory. This technical flaw effectively neutralizes the application's security boundary, enabling arbitrary file write operations in locations outside the expected scope of the download operation.
The operational impact of this vulnerability is severe due to its potential for remote code execution through social engineering tactics. An attacker can craft a deceptive model repository that appears legitimate but contains specific configuration files such as plugin manifest.json, install-state.json, and mcp-bridge-config.json. When an unsuspecting user downloads and installs this malicious package, the application processes these files according to its normal startup routine. The presence of the crafted configuration files triggers the execution of a Python payload supplied by the attacker every time LM Studio is launched. This mechanism allows for persistent access and control over the victim's system without requiring additional exploitation steps after the initial download, turning a simple model installation into a vector for full system compromise.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can resolve to unintended directories or files. Furthermore, the attack methodology maps directly to MITRE ATT&CK techniques related to Initial Access and Persistence. The use of crafted repositories for download corresponds to T1566.002: Spearphishing Attachment, as it relies on tricking users into downloading malicious content. Once installed, the execution of the Python payload upon launch constitutes a persistence mechanism similar to T1547.001: Registry Run Keys / Startup Folder or potentially T1059.006: PowerShell if the payload utilizes that interpreter, ensuring the attacker retains access across system restarts and application launches.
Mitigation strategies for this vulnerability primarily involve immediate software updates. Users must upgrade LM Studio to version 0.4.22+1 or later, where the resolveDownloadRequest function has been patched to strictly validate file paths and prevent directory traversal sequences from resolving outside the intended models directory. In addition to updating, organizations should implement strict application whitelisting policies that restrict the execution of unsigned scripts, particularly Python payloads launched by third-party applications like LM Studio. Network-level controls can also be employed to monitor and block downloads from untrusted or suspicious repositories. Security awareness training is essential to educate users about the risks of downloading models from unofficial sources, as social engineering remains the primary delivery vector for this specific exploitation chain.