Downloading a model should not be the same as installing software. The Injection reports that VulnCheck, on October 30, 2026, published CVE-2026-119979 (CVSS 8.7) against LM Studio: versions before 0.4.22+1 “let a crafted model repository write files outside the models directory, planting configuration that runs an attacker’s Python payload on every launch.” Ariel Fogel of Pillar Security found the issue.
Quick Take
- Product: LM Studio, a popular local-model desktop app.
- Bug: A malicious model repository could write outside the models folder and install a payload that executed on each subsequent launch (CVE-2026-119979, CVSS 8.7).
- Fix: Update LM Studio to 0.4.22+1 or later.
- If you imported models from untrusted repos before the patch: do not just update; inspect or reset application config and consider a clean reinstall.
What happened
LM Studio users often pull models from shared repositories and community sources. If the import path trusts filenames or archive entries from that repository, a crafted package can write into configuration or startup locations instead of the models directory. Once a Python payload is planted to run at launch, every later start of LM Studio is code execution, even if the user never “opens” the malicious model again.
That is a supply-chain bug in the costume of a model download. It is also the kind of thing a prompt-injected agent, or a poisoned README, could steer a user toward.
What you should do
- Update to LM Studio 0.4.22+1 or later on every machine that runs it.
- If you downloaded models from unofficial repositories before updating, treat the app config as untrusted: look for unexpected startup scripts or Python files outside the models folder, or reinstall cleanly and re-import models from sources you trust.
- Do not import model archives from strangers, even after the patch; the update closes this write path, not every future packing trick.
What it means
Local-model apps have become everyday developer tools, and they inherit the same unpack-and-trust problems that browser extensions and IDE plugins had for years. A CVSS 8.7 “runs on every launch” bug is not a theoretical sandbox debate; it is persistence on a laptop that also holds source code and cloud keys. Patch, then check what you already imported.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-44 summary of the VulnCheck advisory for CVE-2026-119979 (October 30, 2026), credited to Ariel Fogel of Pillar Security. i10x did not test LM Studio.
