CVE-2026-33626

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33626
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626 Patch
https://github.com/InternLM/lmdeploy/pull/4447 Issue Tracking Patch
https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3 Release Notes
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq Exploit Mitigation Vendor Advisory
https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*
History

23 Apr 2026, 13:39

Type Values Removed Values Added
References () https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626 - () https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626 - Patch
References () https://github.com/InternLM/lmdeploy/pull/4447 - () https://github.com/InternLM/lmdeploy/pull/4447 - Issue Tracking, Patch
References () https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3 - () https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3 - Release Notes
References () https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq - () https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq - Exploit, Mitigation, Vendor Advisory
First Time Internlm lmdeploy
Internlm
CPE cpe:2.3:a:internlm:lmdeploy:*:*:*:*:*:*:*:*

21 Apr 2026, 20:16

Type Values Removed Values Added
References () https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq - () https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq -

20 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-20 21:16

Updated : 2026-04-23 13:39

NVD link : CVE-2026-33626

Mitre link : CVE-2026-33626

CVE.ORG link : CVE-2026-33626

JSON object : View

Products Affected

internlm

  • lmdeploy
CWE
CWE-918

Server-Side Request Forgery (SSRF)