CVE WATCH / VULNERABILITY DETAIL
CVE-2026-119979
HIGHCVSS 8.8NVD feed
Published 30 October 2026 · tracked since 31 October 2026
Description
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository th
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog