fkie_cve-2026-123818

2026-11-14T12:57:53.453919+00:00

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0.

GHSA-39wr-7q6h-cf68 — LMDeploy has an SSRF bypass

2026-11-14T12:57:53.454285+00:00

Affected: PyPI: lmdeploy

### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.

### Details The current lmdeploy project uses `_is_safe_url` to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks. However, there are indeed differences in parsing between urlparse and the library that actually sends the request. Currently, almost all application scenarios in this project involve first using `_is_safe_url` for URL validation, and then using requests.Session().get to send the request. The core issue: `urlparse()` and `requests` disagree on which host a URL like `http://127.0.0.1:6666\@1.1.1.1` points to:

- `urlparse()` treats `\` as a regular character and `@` as the userinfo-host delimiter, so it extracts hostname as 1.1.1.1 (public) - `requests` treats `\` as a path character, connecting to `127.0.0.1` (internal)

Below is a test code I wrote following the code. ``` from urllib.parse import urlparse import ipaddress import socket import requests

def _is_safe_url(url: str) -> tuple[bool, str]: """Check if the URL is safe to fetch (not inte…

Most recent entries from all

fkie_cve-2026-123818

GHSA-39wr-7q6h-cf68 — LMDeploy has an SSRF bypass