LMDeploy - Server-Side Request Forgery

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery SSRF vulnerability in the vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or...

CVE-2026-33626-Lab

CVE-2026-33626 — LMDeploy 视觉语言 SSRF 实验环境 概述 本仓库重现了 CVE-2026-33626 ，即 LMDeploy 视觉语言图像加载路径中的服务器端请求伪造（SSRF）漏洞。 漏洞行为发生在 LMDeploy 接收图像 URL 时，服务器端图像加载器在不正确阻止内部、私有、回环或链路本地地址的情况下直接获取该 URL。 本实验环境对比： 服务| 版本| 用途 ---|---|--- vuln| LMDeploy 0.12.0| 展示存在漏洞的行为 patched| LMDeploy 0.12.3| 展示修复后的行为 internal| 本地金丝雀服...

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...

PYSEC-2026-4078 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...

PYSEC-2026-4077 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used...

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

DescriptionThe LMdeployimplements anrpc server AsyncRPCServer in zmqrpc.pyfor supporting the RPC communications. In its core functionalitycallandresponse, I found it will directly use thepickles.loadsto deserialize the received messages without any sanitization, hence resulting in a remote code...

PYSEC-2026-4079 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

Description The LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a remote...

PT-2026-105833

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization config.quant dtype value. When a user loads the model with...

PT-2026-105834

Description The LMdeploy implements an rpc server AsyncRPCServer in zmq rpc.py for supporting the RPC communications. In its core functionality call and response, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a...

PT-2026-105832

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recv pyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recv pyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address us...

CVE-2026-33625

creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:22+00:00| published-proof-of-concept| https://github.com/InternLM/lmdeploy/security/advisories/GHSA-3hmm-rh5q-gwwr 2026-09-22 11:40:56+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117314502130222385 2026-09-22...

CVE-2026-33625

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2025-66455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements...

LMDeploy has an SSRF bypass

Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current lmdeploy project uses issafeurl to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...

GHSA-39WR-7Q6H-CF68 LMDeploy has an SSRF bypass

Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current lmdeploy project uses issafeurl to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...

CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2026-33625

LMDeploy versions 0.12.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py (line 620). The quant_dtype value from a model's HuggingFace quantization_config is passed to eval(f'torch.{quant_dtype}') without validation, enabling an attacker who publishes a maliciou...