GHSA-f623-hjm8-5wg5Critical· 8.1▾ MidnightDuplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references.
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
vllm >= 0.7.3, < 0.31.0Upgrade to a patched release:
vllm 0.31.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114053High· 8.1vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
CVE-2026-90553High· 7.8vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes
CVE-2026-22807High· 8.8vLLM is an inference and serving engine for large language models (LLMs)
GHSA-8qpc-6rxx-4pxfHigh· 7.5Duplicate Advisory: vllm p2p never connected zmq_exhaustion
CVE-2026-115912High· 7.5vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
CVE-2026-115913Medium· 6.5vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine