InternLM's LMDeploy LLM serving toolkit exposes an /update_weights endpoint on its OpenAI-compatible api_server. Per VulnCheck, a request can carry a base64-encoded pickle in serialized_named_tensors, which is deserialized with ForkingPickler.loads without validation, running commands as the server process with no authentication.

• Affected: 0.9.0 through 0.18.0 (latest release, Sep 28).
• Fix status: pull request 4964 ("Reject pickle on HTTP /update_weights") was still open when this was published; no patched release yet.
• Exploitation: none reported.

Do now: never expose an LMDeploy api_server to untrusted networks; put it behind an authenticating proxy that blocks /update_weights, and watch for the fixed release.