LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
Title source: cnaExploitation Summary
CVE-2026-33626 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including rootdirective-sec. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-33626, demonstrating an SSRF vulnerability in LMDeploy's vision-language image loading path. It includes Dockerized environments for both vulnerable (0.12.0) and patched (0.12.3) versions, along with a Python PoC script to test the vulnerability.
Description
LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.
Exploits (1)
This repository contains a functional proof-of-concept for CVE-2026-33626, demonstrating an SSRF vulnerability in LMDeploy's vision-language image loading path. It includes Dockerized environments for both vulnerable (0.12.0) and patched (0.12.3) versions, along with a Python PoC script to test the vulnerability.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N