CVE-2026-33626

HIGH SEVERITY

CVSS Score & Metrics

Base Score

7.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N                                    

Vulnerability Description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

Vulnerability Details

Published Date

April 20, 2026

Last Modified

April 20, 2026

CWE ID

CWE-918

Source

NVD

Vendor

InternLM

Product

lmdeploy

External References

https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626
https://github.com/InternLM/lmdeploy/pull/4447
https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq

CVE-2026-33626

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment