LM Studio CVE-2026-119979

Exploitation requires the victim to be tricked into downloading and installing a crafted model repository through LM Studio's built-in model downloader; the malicious repo uses backslash-separated traversal filenames that escape the models directory so that resolveDownloadRequest writes a plugin manifest.json, install-state.json and mcp-bridge-config.json into locations LM Studio reads at startup, causing an attacker-supplied Python payload to run on every launch. The limiting factors are: mandatory user interaction (the victim must choose to fetch the attacker-controlled model, i.e. a social-engineering step), and the affected version range - LM Studio before 0.4.22+1; installations on 0.4.22+1 or later are fixed. There is no path to unattended, fully automatic exploitation without the victim's download action.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) reflects a serious outcome - full high-impact compromise of confidentiality, integrity and availability via attacker-controlled code execution - but the UI:P (passive user interaction) metric is the decisive limiter: exploitation is not autonomous and requires the victim to download a crafted model repository, so this is not wormable network RCE. The vulncheck.today Decision label is 'this_week', not 'act_now' or 'emergency', consistent with a high-severity but interaction-gated issue. No CISA KEV listing and no EPSS score were provided in the input, so there is no signal of active, widespread exploitation; the only exploitation evidence is a VulnCheck advisory reference, which is an advisory, not verified working exploit code. On balance this is a genuine priority to patch promptly because the technical impact is persistent code execution on every launch, but it depends on social-engineering a user into loading a malicious model rather than on unattended remote exploitation. PR:N (unauthenticated from the attacker's side) is accurate in the sense that the attacker needs no account - the gating factor is victim action, not attacker credentials.

An attacker publishes a crafted model repository and lures a user into downloading it through LM Studio's model downloader. The downloader's resolveDownloadRequest mishandles backslash-separated traversal filenames, writing attacker files (plugin manifest.json, install-state.json, mcp-bridge-config.json) outside the intended models directory; on the next launch LM Studio runs the attacker-supplied Python payload. No public, verified working exploit is identified at time of analysis - only a VulnCheck advisory reference exists.