LMDeploy’s vision‑language module contains an SSRF flaw in the load_image() function. The function fetches URLs supplied by users without validating that they target public or safe addresses, permitting an attacker to retrieve arbitrary data from internal or private networks, including cloud metadata services. The vulnerability corresponds to CWE‑918 and could enable attackers to exfiltrate sensitive information or gain additional footholds within a protected environment.

The flaw affects InternLM’s LMDeploy, specifically all releases preceding version 0.12.3. The patch begins with release 0.12.3, which removes the unchecked URL fetch from load_image().

With a CVSS score of 7.5 the flaw is considered high severity. The EPSS score is 3% and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely by directing malicious image URLs to LMDeploy. An attacker only needs to supply an unvalidated URL to the load_image routine, which will then resolve and fetch the resource, potentially exposing internal addresses or data. The description does not specify whether authentication is required; it is inferred that the vulnerability might be exploitible without authentication, but this is not confirmed.