~ / search / GHSA-jfvg-qm4p-473x

GHSA-jfvg-qm4p-473x

InternLM LMDeploy code injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-3163

Packages

EcosystemPackageAffectedFixed in
PyPI lmdeploy <= 0.7.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

References

External links from the advisory. They lead to third-party sites.