# LM Studio: a crafted model repository writes files outside the models folder

> LM Studio before 0.4.22+1 turns one downloaded model repository into persistent code execution on the host.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability, Supply chain
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-30
- **CVE:** CVE-2026-119979
- **CVSS:** 8.7
- **Affects:** LM Studio
- **Research by:** Ariel Fogel (Pillar Security)
- **Primary source:** https://www.vulncheck.com/advisories/lm-studio-before-0.4.22-1-path-traversal-via-model-downloader
- **Page:** https://theinjection.dev/items/vulncheck-lm-studio-model-downloader-traversal/

LM Studio before 0.4.22+1 lets a crafted model repository write files outside the models directory, planting configuration that runs an attacker's Python payload on every launch. Ariel Fogel of Pillar Security found it.

## What happened

VulnCheck published CVE-2026-119979 on October 30, 2026, as the CNA for a path traversal flaw in LM Studio's model downloader. Ariel Fogel of Pillar Security is credited with the finding. VulnCheck states the affected range as every build before 0.4.22+1.

## How it works

The downloader's resolveDownloadRequest function does not keep writes inside the models directory when a filename contains backslash-separated traversal sequences, so a repository can place files anywhere the app can write. VulnCheck describes a crafted model repository that plants a plugin manifest.json, an install-state.json and an mcp-bridge-config.json. Together those files make LM Studio execute an attacker-supplied Python payload each time it starts.

## Who is affected

Every LM Studio installation on a build earlier than 0.4.22+1 is exposed. Exploitation needs the user to download the attacker's model repository: VulnCheck's CVSS 4.0 vector records passive user interaction and no privileges.

## What to do

Upgrade LM Studio to 0.4.22+1, the first build outside the range VulnCheck lists as affected. Until that upgrade is in place, treat model repositories from publishers you do not know as untrusted, because downloading one is the only action the attack requires.

## Quick facts

- **Affected:** LM Studio >= 0, < 0.4.22+1, per VulnCheck
- **Fixed in:** 0.4.22+1
- **CVE:** CVE-2026-119979
- **CVSS:** 8.7 CVSS 4.0, and 8.8 CVSS 3.1, both published by VulnCheck
- **Attack type:** Path traversal in the model downloader via backslash-separated filenames
- **Persistence:** Plugin manifest.json, install-state.json and mcp-bridge-config.json run a Python payload at every launch
- **Found by:** Ariel Fogel, Pillar Security
- **Disclosed:** October 30, 2026, by VulnCheck

## Questions

### Which LM Studio versions are affected by CVE-2026-119979?

LM Studio builds before 0.4.22+1 are affected. VulnCheck's advisory states the range as greater than or equal to 0 and less than 0.4.22+1, so every earlier release carries the model downloader flaw. The advisory lists no partial mitigation and no configuration that removes the exposure, which leaves upgrading as the only remedy it supports.

### How does an attacker reach an LM Studio user with this flaw?

The attack begins when a user downloads a crafted model repository, which VulnCheck describes as the required step. Backslash-separated traversal sequences in that repository's filenames then push file writes outside the models directory. VulnCheck's CVSS 4.0 vector records passive user interaction and no privileges, so the victim takes one normal action, fetching a model, and nothing more.

### What makes this more serious than an ordinary path traversal bug?

Writing outside the models directory lets the crafted repository plant a plugin manifest.json, an install-state.json and an mcp-bridge-config.json, according to VulnCheck. Those files make LM Studio run an attacker-supplied Python payload at every launch. One download therefore becomes persistent code execution on the host, rather than a single stray file write.

### Does the LM Studio 0.4.22 changelog mention this security fix?

No. The LM Studio 0.4.22 changelog lists Linux startup fixes, new assistant drafters and image support for tool results, and names no path traversal or model downloader fix. VulnCheck's advisory is what ties the fix to build 0.4.22+1, and its references point at that same changelog page. Defenders tracking this CVE should follow the advisory.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/lm-studio-before-0.4.22-1-path-traversal-via-model-downloader)
2. [LM Studio 0.4.22 Notes](https://lmstudio.ai/changelog/lmstudio/lmstudio-v0.4.22)