{"affected":[{"product":"lmdeploy","source":"CNA: GitHub_M","vendor":"InternLM","versions":[{"status":"affected","version":">= 0.12.3, < 0.15.0"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"lmdeploy","product":"lmdeploy","source":"OSV GHSA-39wr-7q6h-cf68","vendor":"","versions":[{"status":"affected","version":"0.12.3","versionType":"PyPI"},{"status":"affected","version":"0.13.0","versionType":"PyPI"},{"status":"affected","version":"0.14.0","versionType":"PyPI"},{"events":[{"introduced":"0.12.3"},{"fixed":"0.15.0"}],"status":"unknown","version":"0.12.3","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-123818","cwes":["CWE-918"],"description":"LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled remote media URLs can therefore be induced to access internal HTTP services and expose data available from those services. This issue is fixed in version 0.15.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794259807741,"publishedAt":1794259191856,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/InternLM/lmdeploy/security/advisories/GHSA-39wr-7q6h-cf68"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/InternLM/lmdeploy/pull/4734"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/InternLM/lmdeploy/commit/03c313006d17cc3feae86b633c44206a997c44db"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/InternLM/lmdeploy/releases/tag/v0.15.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-39wr-7q6h-cf68"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-39wr-7q6h-cf68"}],"remediation":[{"kind":"fix","source":"OSV GHSA-39wr-7q6h-cf68","text":"lmdeploy (PyPI): OSV reports a fixed version 0.15.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-39wr-7q6h-cf68"}],"revision":"a37499588fe3ca4fc294304b23f6228e18b8ec5447d400f19aa530f7168c028d","sources":[{"modifiedAt":1794259191856,"name":"CNA: GitHub_M","retrievedAt":1794262162026,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123818"},{"modifiedAt":1794259807741,"name":"OSV / GitHub Security Advisories","retrievedAt":1794262163047,"url":"https://osv.dev/vulnerability/GHSA-39wr-7q6h-cf68"}],"ssvc":null,"status":"published","title":"LMDeploy URL parser disagreement permits SSRF filter bypass","updatedAt":1794262163047}