CVE-2026-123818

LMDeploy is a toolkit for compressing, deploying, and serving large language models.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation hostname appears globally routable but whose request destination resolves to an internal host, bypassing non-global address checks. Applications that accept attacker-controlled…

9. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-123818