Live › vulnerability › CVE-2026-114053
Go to dashboardvLLM before 0.31.0 passes a client-supplied code revision to Transformers when trust_remote_code is enabled, so a model repository revision chosen by the request can have its processor code imported. An attacker who controls such a revision can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
pip show vllm versions from 0.7.3 up to but not including 0.31.0 are affected0.31.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
This page as .md · .json · in your agent: get_signal("CVE-2026-114053")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.