GHSA-jfvg-qm4p-473xMediumCVSS 5.3

InternLM LMDeploy code injection vulnerability

Published
April 3, 2025
Last Modified
April 23, 2025

🔗 CVE IDs covered (1)

📋 Description

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

🎯 Affected products1

  • pip/lmdeploy:<= 0.7.1

🔗 References (7)