CVE-2026-73560Medium· 6.5▾ SunlitvLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.
vllm < 0.26.0Upgrade past the affected range:
vllm 0.26.0Affected packages:
vllm < 0.26.0Patched in:
vllm 0.26.0Source: https://osv.dev/vulnerability/GHSA-4hhp-h66f-j5j7
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69147Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-73558Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-71486Medium· 4.3vLLM is an inference and serving engine for large language models
CVE-2026-73555Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-73556Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-73557Medium· 5.3vLLM is an inference and serving engine for large language models