Path Traversal Vulnerability in LM Studio by LM Technologies

CVE-2026-119979

What is CVE-2026-119979?

LM Studio prior to version 0.4.22+1 is susceptible to a path traversal flaw in its model downloader. This vulnerability enables attackers to write files outside the intended models directory by employing backslash-separated traversal filenames. By deceiving users into downloading a malicious model repository, attackers can inject harmful files such as plugin manifest.json, install-state.json, and mcp-bridge-config.json. Subsequently, these files execute an attacker-controlled Python payload each time the application is launched, posing a significant security risk.

References