# LMDeploy SSRF bypass in URL validation

Source: https://junglewise.ai/threats/lmdeploy-ssrf-bypass-in-url-validation-c4a40a8d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-09-18

LMDeploy is a toolkit for deploying and serving large language models. The application performs URL validation to prevent server-side request forgery (SSRF) attacks against internal services, but an attacker can bypass this validation using a specially crafted URL with a backslash character, allowing them to reach internal networks or services that should be blocked.

Technologies: [lmdeploy (PyPI)](https://junglewise.ai/threats/technologies/lmdeploy). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 18 September 2026.

**Which products and versions are affected?** lmdeploy (PyPI) ECOSYSTEM:introduced=0.12.3,fixed=0.15.0.

**Is there a fix for This vulnerability?** Yes. lmdeploy (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run lmdeploy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lmdeploy (PyPI): upgrade to 0.15.0 or later

  ```sh
  pip install "lmdeploy>=0.15.0"
  ```


## Technical details

The vulnerability exists in LMDeploy's _is_safe_url function, which uses Python's urlparse() to validate URLs before making requests via requests.Session().get(). The root cause is a parsing difference between urlparse and requests: a URL like "http://127.0.0.1:6666\@1.1.1.1" is parsed by urlparse as pointing to 1.1.1.1 (public IP, passes validation), but requests interprets the backslash as a path character and connects to 127.0.0.1 (private IP, bypasses check). No authentication is required—any caller of URL-fetching functions is vulnerable. An attacker can bypass SSRF protections and access internal services like databases, metadata endpoints, or internal APIs. The vulnerability was fixed in version 0.15.0; affected versions are 0.12.3 through 0.14.x.

## Affected products

- InternLM LMDeploy 0.12.3 to 0.14.x

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: fixed in version 0.15.0

## References

- [https://github.com/InternLM/lmdeploy/security/advisories/GHSA-39wr-7q6h-cf68](https://github.com/InternLM/lmdeploy/security/advisories/GHSA-39wr-7q6h-cf68)
- [https://github.com/InternLM/lmdeploy](https://github.com/InternLM/lmdeploy)

## Related threats

- [LMDeploy arbitrary code execution via eval() of untrusted quant_dtype](https://junglewise.ai/threats/cve-2026-33625-lmdeploy-arbitrary-code-execution-via-eval-of-untrusted-quant)
- [LMDeploy remote code execution via pickle deserialization in DistServe](https://junglewise.ai/threats/cve-2025-66455-lmdeploy-remote-code-execution-via-pickle-deserialization-in)
- [LMdeploy remote code execution via pickle deserialization in zmq_rpc](https://junglewise.ai/threats/cve-2025-59953-lmdeploy-remote-code-execution-via-pickle-deserialization-in-zmq)
- [PYSEC-2026-1579 - InternLM LMDeploy code injection vulnerability](https://junglewise.ai/threats/cve-2025-3163-internlm-lmdeploy-code-injection-vulnerability)
- [PYSEC-2026-1577 - LMDeploy Improper Input Validation Vulnerability](https://junglewise.ai/threats/cve-2025-3162-lmdeploy-improper-input-validation-vulnerability)