~ / search / GHSA-7vc5-mjwp-c8fq

GHSA-7vc5-mjwp-c8fq

LMDeploy Improper Input Validation Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-3162

Packages

EcosystemPackageAffectedFixed in
PyPI lmdeploy <= 0.7.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been classified as critical. Affected is the function load_weight_ckpt of the file lmdeploy/lmdeploy/vl/model/utils.py of the component PT File Handler. The manipulation leads to deserialization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

References

External links from the advisory. They lead to third-party sites.