Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Low severity, with a CVSS score of 3.1, published 18 September 2026.
- Which products and versions are affected?
- lmdeploy (PyPI) ECOSYSTEM:introduced=0.12.3,fixed=0.15.0.
- Is there a fix for This vulnerability?
- Yes. lmdeploy (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network.
- Am I affected?
- Check whether you run lmdeploy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- lmdeploy (PyPI): upgrade to 0.15.0 or later
pip install "lmdeploy>=0.15.0"
Technical details
The vulnerability exists in LMDeploy's _is_safe_url function, which uses Python's urlparse() to validate URLs before making requests via requests.Session().get(). The root cause is a parsing difference between urlparse and requests: a URL like "http://127.0.0.1:6666\@1.1.1.1" is parsed by urlparse as pointing to 1.1.1.1 (public IP, passes validation), but requests interprets the backslash as a path character and connects to 127.0.0.1 (private IP, bypasses check). No authentication is required—any caller of URL-fetching functions is vulnerable. An attacker can bypass SSRF protections and access internal services like databases, metadata endpoints, or internal APIs. The vulnerability was fixed in version 0.15.0; affected versions are 0.12.3 through 0.14.x.
Affected products
- InternLM LMDeploy 0.12.3 to 0.14.x
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: fixed in version 0.15.0