GitHub Advisoryadvisory · PyPI

GHSA-jfvg-qm4p-473x InternLM LMDeploy code injection vulnerability

MEDIUM Published 2025-04-03 Modified 2025-04-23 Official page ↗
Aliases
CVE-2025-3163
Ecosystem
PyPI
Packages
lmdeploy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-74, CWE-94
Reviewed
2025-04-23

Affected packages

• PyPI lmdeploy: <= 0.7.1 (no fix yet)

Description

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-3163 A vulnerability was found in InternLM LMDeploy up to 0.7.1. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References