EUVD-2026-23970
GHSA-6w67-hwm5-92mq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
8DescriptionGitHub Advisory
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.
Articles & Coverage 1
AnalysisAI
Server-Side Request Forgery (SSRF) in InternLM LMDeploy's vision-language module allows remote unauthenticated attackers to access cloud metadata services, internal networks, and sensitive resources through unvalidated URL fetching in the load_image() function. Affects all versions prior to 0.12.3. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the LMDeploy deployment to expose the vision-language module's image processing API (specifically any endpoint that accepts user-supplied image URLs and invokes the load_image() function in lmdeploy/vl/utils.py). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is HIGH for deployments exposing LMDeploy's vision-language API to untrusted networks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an internet-facing LMDeploy instance with vision-language capabilities deployed in AWS EC2. They send a crafted inference request with an image URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata service). … |
| Remediation | Upgrade to InternLM LMDeploy version 0.12.3 or later immediately, as confirmed by the official release at https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all InternLM LMDeploy deployments and identify running versions below 0.12.3; isolate affected instances from production if version cannot be confirmed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today