LM Studio: a crafted model repository writes files outside the models folder
LM Studio before 0.4.22+1 turns one downloaded model repository into persistent code execution on the host.
· VulnCheck · Research by Ariel Fogel (Pillar Security)
LM Studio before 0.4.22+1 lets a crafted model repository write files outside the models directory, planting configuration that runs an attacker's Python payload on every launch. Ariel Fogel of Pillar Security found it.
01What happened
VulnCheck published CVE-2026-119979 on October 30, 2026, as the CNA for a path traversal flaw in LM Studio's model downloader. Ariel Fogel of Pillar Security is credited with the finding. VulnCheck states the affected range as every build before 0.4.22+1.
02How it works
The downloader's resolveDownloadRequest function does not keep writes inside the models directory when a filename contains backslash-separated traversal sequences, so a repository can place files anywhere the app can write. VulnCheck describes a crafted model repository that plants a plugin manifest.json, an install-state.json and an mcp-bridge-config.json. Together those files make LM Studio execute an attacker-supplied Python payload each time it starts.
03Who is affected
Every LM Studio installation on a build earlier than 0.4.22+1 is exposed. Exploitation needs the user to download the attacker's model repository: VulnCheck's CVSS 4.0 vector records passive user interaction and no privileges.
04What to do
Upgrade LM Studio to 0.4.22+1, the first build outside the range VulnCheck lists as affected. Until that upgrade is in place, treat model repositories from publishers you do not know as untrusted, because downloading one is the only action the attack requires.
Questions people ask
- Which LM Studio versions are affected by CVE-2026-119979?
- LM Studio builds before 0.4.22+1 are affected. VulnCheck's advisory states the range as greater than or equal to 0 and less than 0.4.22+1, so every earlier release carries the model downloader flaw. The advisory lists no partial mitigation and no configuration that removes the exposure, which leaves upgrading as the only remedy it supports.
- How does an attacker reach an LM Studio user with this flaw?
- The attack begins when a user downloads a crafted model repository, which VulnCheck describes as the required step. Backslash-separated traversal sequences in that repository's filenames then push file writes outside the models directory. VulnCheck's CVSS 4.0 vector records passive user interaction and no privileges, so the victim takes one normal action, fetching a model, and nothing more.
- What makes this more serious than an ordinary path traversal bug?
- Writing outside the models directory lets the crafted repository plant a plugin manifest.json, an install-state.json and an mcp-bridge-config.json, according to VulnCheck. Those files make LM Studio run an attacker-supplied Python payload at every launch. One download therefore becomes persistent code execution on the host, rather than a single stray file write.
- Does the LM Studio 0.4.22 changelog mention this security fix?
- No. The LM Studio 0.4.22 changelog lists Linux startup fixes, new assistant drafters and image support for tool results, and names no path traversal or model downloader fix. VulnCheck's advisory is what ties the fix to build 0.4.22+1, and its references point at that same changelog page. Defenders tracking this CVE should follow the advisory.
Sources 2 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2lmstudio.aiLM Studio 0.4.22 Notes