CVE-2025-3163 MEDIUM

CVE-2025-3163: InternLM LMDeploy conf.py open code injection

Vendor Internlm
Product LMDeploy
Weakness CWE-94 · Code injection
Published April 3, 2025
Last update April 21, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

April 3, 2025 CVE published
April 21, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-21656 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution CVE-2024-7650 Remote code execution vulnerability discovered in OpenText™ Directory Services CE 23.4 CVE-2026-41148 Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection CVE-2026-46517 LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out CVE-2025-1510 Custom Post Type Date Archives <= 2.7.1 - Missing Authorization to Unauthenticated Arbitrary Shortcode Execution