{"id":"CVE-2026-107204","revision":"61ae659542c0449fac933c0c4dba2000","records":[{"revision":"61ae659542c0449fac933c0c4dba2000","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107204","aliases":[],"title":"LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint","description":"LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.","state":0,"publishedAt":"2026-10-07T15:24:03.214+00:00","modifiedAt":"2026-10-07T17:09:21.989+00:00","affected":[{"ecosystem":"Vendor product","name":"LMCache","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"LMCache\",\n                    \"product\": \"LMCache\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:pypi/lmcache\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"0.5.5\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/LMCache/LMCache/issues/5510","https://github.com/LMCache/LMCache","https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/internal_api_server/common/run_script_api.py#L54-L76","https://github.com/LMCache/LMCache/blob/v0.5.5/lmcache/v1/multiprocess/http_apis/common_api.py#L41-L46","https://www.vulncheck.com/advisories/lmcache-through-0.5.5-unauthenticated-rce-via-run-script-endpoint"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107204","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107204","identifiers":["CVE-2026-107204"]},"retained":false,"historicalAffected":[]}],"coverage":[]}