Live › vulnerability › GHSA-f623-hjm8-5wg5
Go to dashboardvLLM forwards a client-supplied code_revision in multimodal requests to Transformers AutoProcessor, which imports dynamic processor code from that revision when trust_remote_code is enabled. An attacker who controls a revision of the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:39 UTC. All times on this page are UTC.
Teams running vLLM between 0.7.3 and 0.31.0 with trust_remote_code enabled, serving models whose repository revisions could be attacker-controlled. The /tokenize endpoint is unauthenticated, so exposure to untrusted clients is the main risk. Deployments with trust_remote_code disabled or without network exposure can deprioritize this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vllm | pypi | >= 0.7.3, < 0.31.0 | 0.31.0 |
pip show vllm; affected range is >=0.7.3 and <0.31.0.trust_remote_code enabled (for example --trust-remote-code).0.31.0 or later.trust_remote_code and do not serve models from untrusted repositories.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references.
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
This page as .md · .json · in your agent: get_signal("GHSA-f623-hjm8-5wg5")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.