CVE-2025-3163: InternLM LMDeploy conf.py open code injection
Published Apr 3, 2025
·Updated
A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Affected Software
3 affected components
InternLM LMDeploy<=0.7.1
pip/lmdeploy<=0.7.1
InternLM LMDeploy<=0.7.1
Event History
Apr 3, 2025
CVE Published
via MITRE·03:31 PM
Data Sourced
via MITRE·03:31 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·06:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-3163?
CVE-2025-3163 is classified as a critical severity vulnerability.
2
How do I fix CVE-2025-3163?
To mitigate CVE-2025-3163, upgrade InternLM LMDeploy to version 0.7.2 or later.
3
What type of vulnerability is CVE-2025-3163?
CVE-2025-3163 is a code injection vulnerability.
4
In which file is CVE-2025-3163 found?
CVE-2025-3163 is found in the Open function of lmdeploy/docs/en/conf.py.
5
Who is affected by CVE-2025-3163?
CVE-2025-3163 affects all versions of InternLM LMDeploy up to and including 0.7.1.