Remote URL Validation Flaw in LMDeploy by InternLM

CVE-2026-123818

What is CVE-2026-123818?

LMDeploy, a toolkit for deploying large language models, has a vulnerability in versions 0.12.3 to 0.15.0 that arises from improper validation of remote media URLs. The toolkit uses urlparse for validation, but this method can be bypassed due to how requests.Session().get handles backslashes. This could allow an attacker to craft a malicious URL leading to an internal HTTP service, potentially exposing sensitive data. Users are recommended to upgrade to version 0.15.0 or later for protection against this issue.

References