Executive brief
LMDeploy is a model deployment tool that fetches remote content via HTTP. The URL validation logic contains a flaw that allows attackers to bypass security checks and make the application connect to internal network addresses (such as localhost or private IP ranges), potentially exposing sensitive internal services or data.
Technical details
The vulnerability is a URL parsing inconsistency between the validation function (_is_safe_url) and the HTTP request library. urlparse() and requests interpret backslash characters differently in URLs: urlparse treats a URL like "http://127.0.0.1:6666\@1.1.1.1" as pointing to 1.1.1.1 (extracting the hostname after @), while requests treats the backslash as a path separator and connects to 127.0.0.1 instead. An attacker can craft a malicious URL that passes the security validation but connects to an internal address, achieving Server-Side Request Forgery (SSRF). The attack is network-reachable and requires no authentication. An attacker gains the ability to access internal services, bypass firewall controls, and potentially exfiltrate sensitive data.
Affected products
- LMDeploy LMDeploy <unknown
Timeline
- 2026-09-18: disclosed