THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-39wr-7q6h-cf68 (high) — LMDeploy has an SSRF bypass

[GHSA] GHSA-39wr-7q6h-cf68 (high) — LMDeploy has an SSRF bypass

highgithub_advisoriesPublished 2026-09-18

GHSA-39wr-7q6h-cf68 Severity: high CVE: None

LMDeploy has an SSRF bypass

### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.

### Details The current lmdeploy project uses `_is_safe_url` to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent

Indicators of compromise

Original source: https://github.com/advisories/GHSA-39wr-7q6h-cf68