LMDeploy - Server-Side Request Forgery

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery SSRF vulnerability in the vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or...

CVE-2026-33626-Lab

CVE-2026-33626 — LMDeploy Vision-Language SSRF Lab Overview This repository reproduces CVE-2026-33626 , a Server-Side Request Forgery SSRF vulnerability in LMDeploy's vision-language image loading path. The vulnerable behavior occurs when LMDeploy receives an image URL and the server-side image...

CVE-2026-123818

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-123818 LMDeploy URL parser disagreement permits SSRF filter bypass

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

EUVD-2026-120455

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-123818 LMDeploy URL parser disagreement permits SSRF filter bypass

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-123818

The LMDeploy toolkit, used for deploying and serving large language models, is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.12.3 through 0.14.x . The vulnerability stems from a logical flaw in the _is_safe_url function, where urlparse and requests.Session().get interpret backsla...

CVE-2026-123818: InternLM lmdeploy: LMDeploy is a toolkit for compressing, deploying, and serving large language models

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

EUVD-2026-114111

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-119706

InternLM LMDeploy versions 0.9.0 through 0.18.0 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The root cause is the insecure deserialization of untrusted data via the /update_weights endpoint. Specifically, the ForkingPickler.loads function fails to validate base...

CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

PT-2026-133640

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions 0.9.0 through 0.18.0 Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the api server process. This occurs when the server receives specially crafte...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summarylmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with lmdeplo...

PYSEC-2026-4078 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with...

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...