LM Studio before 0.4.22 Build 1: model-download path traversal plants a plugin that runs on every launch (CVE-2026-119979, 8.7)

View raw markdownEdit on GitHub ↗

TL;DR

LM Studio before 0.4.22 Build 1 had a path traversal in the model downloader's resolveDownloadRequest: a filename with backslash-separated traversal in a crafted model repository wrote files outside the models directory, and the record says an attacker who gets a user to download such a repository can plant a plugin manifest.json, install-state.json and mcp-bridge-config.json so that attacker-supplied Python runs on every launch (CVE-2026-119979, VulnCheck, 2026-10-30, CVSS 4.0 8.7 and 3.1 8.8; credit Ariel Fogel of Pillar Security). The fix shipped in 0.4.22 Build 1 on 2026-08-28 with release notes that say nothing about it; the current release is 0.4.28. Update, and treat a model repository as code.

What happened

VulnCheck published the CNA record on 2026-10-30 (17:48 UTC) naming Element Labs' LM Studio, versions from 0 before 0.4.22+1, whose description reads: "LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch." In other words the downloader resolves a model file's name without rejecting backslash traversal, so a repository the user chooses to download can place files anywhere the app can write. The record's chosen target is LM Studio's own plugin system: a planted plugin manifest, install state and an MCP bridge configuration make the app load and run an attacker-supplied Python payload at each start. User interaction is the download itself (UI:P in the 4.0 vector; UI:R in 3.1); no privileges are required and the vector is network because the repository is remote. The GitHub Advisory Database carries the record as GHSA-fv7x-c662-7ccq (unreviewed, High, 2026-10-30) with no package and "Unknown" ranges.

The vendor's own record is thinner than the CNA's. LM Studio's changelog for 0.4.22 Build 1, dated 2026-08-28, lists support for assistant drafters, images returned by tools in the OpenAI- and Anthropic-compatible endpoints, and seven Linux fixes; there is no security entry, no reference to the downloader and no credit. 0.4.23 Build 1 (2026-09-09) is a reliability note. The download page offered 0.4.28 on 2026-10-31. That is the silent-fix shape this corpus has recorded for Claude Code's sandbox bypasses: a version a user on auto-update already has, disclosed two months later by a research CNA, with nothing in the vendor's notes to tell a reader pinned to an older build why to move. Pillar Security's blog had no post on LM Studio when read on 2026-10-31, so the only descriptions are the CNA record and VulnCheck's advisory page, which repeats it.

Why it matters here. LM Studio is how many developers run local models behind an OpenAI-compatible endpoint and, since it gained an MCP bridge, how agents on the machine reach tools. A model repository is something a user picks from a catalogue and downloads in one click; the record turns that click into a persistence mechanism inside the app that holds the local API server. The planted artefact is a plugin, so it survives the model being deleted. This is the local-app analogue of the qwen2-tiny trust_remote_code repositories: there the repository's config asks the loader to run code, here the repository's filenames tell the downloader where to write it.

Am I affected?

Check the version in the app (Settings or About) against 0.4.22 Build 1; the download page serves 0.4.28. If you ran an older build and downloaded a model from a publisher you do not recognise, review the app's installed plugins and MCP bridge configuration for entries you did not add, and remove any you cannot account for. The record names the three files the attacker plants (manifest.json, install-state.json, mcp-bridge-config.json) inside a plugin directory; it does not publish the directory path, and this file does not guess one. A model you downloaded from a well-known publisher's own repository is not the case described.

If you are affected

Update LM Studio, remove the unexpected plugin, and treat the machine as having run attacker code at each launch since the download: rotate keys the local server or its MCP tools could reach, and review what the plugin's Python could have touched. If your local AI agent was exploited, rotating cloud credentials.

Prevention

  • Keep desktop AI apps on their current release; silent fixes mean the changelog will not tell you when a build matters.
  • Download models from the publisher's own repository and treat an unfamiliar repository as an installer, not a file.
  • Run local model servers and MCP bridges with the least access they need; agent-sandboxing, mcp-hygiene.

Sources