CVE-2026-119979

Name of the Vulnerable Software and Affected Versions LM Studio versions prior to 0.4.22+1

Description A path traversal issue exists in the model downloader's resolveDownloadRequest() function. This allows attackers to write files outside the designated models directory by using backslash-separated traversal filenames. An attacker can trick a user into downloading a specially crafted model repository that includes a plugin manifest.json, install-state.json, and mcp-bridge-config.json, which enables the execution of an attacker-supplied Python payload every time the application is launched.

Recommendations Update to version 0.4.22+1 or later.