{"id":"CVE-2026-114053","kind":"vulnerability","aliases":["CVE-2026-114053"],"related":[],"title":"vLLM: request field lets a repo revision run arbitrary Python on the server","description":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","summary":"vLLM before 0.31.0 passes a client-supplied code revision to Transformers when trust_remote_code is enabled, so a model repository revision chosen by the request can have its processor code imported. An attacker who controls such a revision can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.","severity":"critical","cvss":9.2,"epss":0.00462,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-serving","python","self-hosted","vllm"],"not_affected_if":["managed-hosting","trust_remote_code-disabled","vllm-0.31.0-or-later"],"how_to_check":"Check the installed vLLM version with pip show vllm; versions from 0.7.3 up to but not including 0.31.0 are affected.\nCheck whether trust_remote_code is enabled in the vLLM server launch arguments or config.","fix":"Upgrade vLLM to 0.31.0 or later.\nUntil upgraded, disable trust_remote_code and serve only models whose repositories you control.","status":"open","published_at":"2026-10-21T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:31+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:33:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vLLM to 0.31.0 or later.\nUntil upgraded, disable trust_remote_code and serve only models whose repositories you control.","reach":"network","title":"vLLM: request field lets a repo revision run arbitrary Python on the server","impact":"high","summary":"vLLM before 0.31.0 passes a client-supplied code revision to Transformers when trust_remote_code is enabled, so a model repository revision chosen by the request can have its processor code imported. An attacker who controls such a revision can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.","category":"ai-tooling","who_cares":["vllm","python","self-hosted","llm-serving"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary Python inside the vLLM API process.","analyst_note":"Confirm the exact affected range and whether the unauthenticated /tokenize endpoint is reachable without trust_remote_code; check the NVD entry linked at https://nvd.nist.gov/vuln/detail/CVE-2026-114053.","how_to_check":"Check the installed vLLM version with pip show vllm; versions from 0.7.3 up to but not including 0.31.0 are affected.\nCheck whether trust_remote_code is enabled in the vLLM server launch arguments or config.\nunknown","needs_analyst":true,"not_affected_if":["trust_remote_code-disabled","managed-hosting","vllm-0.31.0-or-later"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000588,"input_tokens":3006,"output_tokens":575,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114053':16A,19A '-2026':15A,18A '/tokenize':79B,144C '0.31.0':33B,94C '0.7.3':92C 'ai':21B 'ai-tool':20B 'api':88B,153C 'arbitrari':9A,83B,148C 'attack':65B,127C 'autoprocessor.from':104C 'chosen':54B 'client':37B,107C 'client-suppli':36B 'code':39B,46B,62B,117C,123C 'control':67B,128C 'cve':14A,17A 'dynam':115C 'enabl':48B,125C 'endpoint':80B,145C 'execut':82B,147C 'field':3A 'forward':95C 'host':29B 'import':63B,119C 'let':4A,106C 'llm':24B 'llm-serv':23B 'mm_processor_kwargs.code':100C 'model':51B,113C,134C 'multimod':74B,139C 'pass':34B 'pretrain':105C 'process':89B,154C 'processor':61B,116C 'python':10A,26B,84B,149C 'remot':45B,122C 'repo':6A 'repositori':52B,135C 'request':2A,57B,75B,98C,140C 'request-suppli':97C 'revis':7A,40B,53B,70B,101C,110C,130C 'run':8A 'select':108C 'self':28B 'self-host':27B 'send':72B,137C 'serv':25B,133C 'server':13A 'suppli':38B,99C 'tool':22B 'transform':42B,103C 'trust':44B,121C 'unauthent':78B,143C 'vllm':1A,30B,31B,87B,90C,152C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114053","severity":null,"published_at":"2026-10-21T01:17:28+00:00","modified_at":"2026-10-22T15:44:59+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114053","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114053","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}