Executive brief
LMDeploy is a toolkit for deploying and serving large language models. The application performs URL validation to prevent server-side request forgery (SSRF) attacks against internal services, but an attacker can bypass this validation using a specially crafted URL with a backslash character, allowing them to reach internal networks or services that should be blocked.
Technical details
The vulnerability exists in LMDeploy's _is_safe_url function, which uses Python's urlparse() to validate URLs before making requests via requests.Session().get(). The root cause is a parsing difference between urlparse and requests: a URL like "http://127.0.0.1:6666\@1.1.1.1" is parsed by urlparse as pointing to 1.1.1.1 (public IP, passes validation), but requests interprets the backslash as a path character and connects to 127.0.0.1 (private IP, bypasses check). No authentication is required—any caller of URL-fetching functions is vulnerable. An attacker can bypass SSRF protections and access internal services like databases, metadata endpoints, or internal APIs. The vulnerability was fixed in version 0.15.0; affected versions are 0.12.3 through 0.14.x.
Affected products
- InternLM LMDeploy 0.12.3 to 0.14.x
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: fixed in version 0.15.0