PYSEC-2026-1579
InternLM LMDeploy code injection vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2025-3163
- Alias
- GHSA-jfvg-qm4p-473x
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Description
A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · lmdeploy | introduced 0, last affected 0.7.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2025-3163 ADVISORY
- https://github.com/InternLM/lmdeploy/issues/3254 WEB
- https://github.com/InternLM/lmdeploy/issues/3254#issue-2918865448 WEB
- https://github.com/InternLM/lmdeploy PACKAGE
- https://vuldb.com/?ctiid.303109 WEB
- https://vuldb.com/?id.303109 WEB
- https://vuldb.com/?submit.542527 WEB
- https://pypi.org/project/lmdeploy PACKAGE
- https://github.com/advisories/GHSA-jfvg-qm4p-473x ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |