CVE-2026-107204

Name of the Vulnerable Software and Affected Versions LMCache versions 0.5.5 and earlier

Description An unauthenticated remote code execution issue exists where remote attackers can execute Python code by sending scripts to the '/run script' endpoint. By leveraging the injected FastAPI app object, attackers can recover real builtins to bypass the guarded import function, allowing them to import the os module and execute operating system commands with the privileges of the LMCache process.

Recommendations Update LMCache to a version later than 0.5.5. As a temporary mitigation, restrict access to the '/run script' endpoint.