Yüksek CVSS 7.5 PoC var
CVE-2026-33626: Lmdeploy: sunucu taraflı istek sahteciliği (SSRF)
Açıklama (NVD)
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.
Özet bilgiler
- Ürün
- Internlm Lmdeploy
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %45,25 (yüzdelik 99)
- CWE
- CWE-918
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| internlm-lmdeploy | — | — | 0.12.3 |