7.5 HighCWE-918
CVE-2026-33626
InternLM lmdeploy vulnerability
InternLMlmdeploy
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
45%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
7.5High
Description NVD
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.
Coverage 1 article · 1 outlet
- LMDeploy SSRF flaw used hours after CVE-2026-33626 releaseThe Hacker News · first in our coverage