Vulnerabilities

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models, contains a server-side request forgery (SSRF) flaw in its vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs supplied to image-loading requests without validating that the resolved host is not an internal or private IP address, so any unauthenticated network caller can direct the server to request attacker-chosen URLs. An attacker can leverage this to reach cloud metadata services (e.g., to steal instance credentials), probe internal networks, and access other sensitive resources reachable from the LMDeploy server. Anyone running LMDeploy versions prior to 0.12.3, particularly deployments exposing the vision-language serving API to untrusted networks, is affected. The flaw was reportedly exploited in the wild within 13 hours of disclosure, and version 0.12.3 patches the issue.

Do: Upgrade to LMDeploy 0.12.3 or later. Until patched, restrict network access to LMDeploy serving endpoints, apply egress filtering so the server can only reach approved hosts, and block requests to private IP ranges and cloud metadata endpoints (e.g., 169.254.169.254); review server logs for unexpected outbound URL fetches or signs of metadata-service access.

LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious .bin or .pt model file. This issue has been patched in version 0.11.1.

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.