{"id":"GHSA-f623-hjm8-5wg5","kind":"vulnerability","aliases":["GHSA-f623-hjm8-5wg5"],"related":[],"title":"Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references.\n\n## Original Description\nvLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.","summary":"vLLM forwards a client-supplied code_revision in multimodal requests to Transformers AutoProcessor, which imports dynamic processor code from that revision when trust_remote_code is enabled. An attacker who controls a revision of the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.","severity":"critical","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vllm","fixed":["0.31.0"],"affected":">= 0.7.3, < 0.31.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-inference","ai-tooling","cwe-94","python","self-hosted","vllm"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":"- Check the installed version with `pip show vllm`; affected range is `>=0.7.3` and `<0.31.0`.\n- Check whether the server starts with `trust_remote_code` enabled (for example `--trust-remote-code`).\n- Check whether the API port is reachable from untrusted networks.","fix":"- Upgrade vLLM to `0.31.0` or later.\n- Until upgraded, disable `trust_remote_code` and do not serve models from untrusted repositories.\n- Restrict network access to the vLLM API port.","status":"withdrawn","published_at":"2026-10-21T03:32:16+00:00","first_seen_at":"2026-10-27T15:39:16+00:00","triaged_at":"2026-10-27T15:39:47+00:00","updated_at":"2026-10-27T15:39:47+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T15:39:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vLLM to `0.31.0` or later.\n- Until upgraded, disable `trust_remote_code` and do not serve models from untrusted repositories.\n- Restrict network access to the vLLM API port.","reach":"internet","title":"vLLM: request-selected processor revision lets clients run arbitrary Python","impact":"high","summary":"vLLM forwards a client-supplied code_revision in multimodal requests to Transformers AutoProcessor, which imports dynamic processor code from that revision when trust_remote_code is enabled. An attacker who controls a revision of the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint and execute arbitrary Python in the vLLM API process.","category":"ai-tooling","nicknames":[],"who_cares":["python","vllm","self-hosted","ai-inference"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary Python runs inside the vLLM API server process","analyst_note":"","how_to_check":"- Check the installed version with `pip show vllm`; affected range is `>=0.7.3` and `<0.31.0`.\n- Check whether the server starts with `trust_remote_code` enabled (for example `--trust-remote-code`).\n- Check whether the API port is reachable from untrusted networks.","needs_analyst":false,"not_affected_if":["default-config","managed-hosting","auth-required"],"who_is_affected":"Teams running vLLM between 0.7.3 and 0.31.0 with trust_remote_code enabled, serving models whose repository revisions could be attacker-controlled. The /tokenize endpoint is unauthenticated, so exposure to untrusted clients is the main risk. Deployments with trust_remote_code disabled or without network exposure can deprioritize this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000681,"input_tokens":3511,"output_tokens":659,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-94':31B '/tokenize':84B,177C '0.31.0':127C '0.7.3':125C '5wg5':17A,22A '6mm3':111C 'advisori':2A,96C,98C 'ai':25B,28B 'ai-infer':24B 'ai-tool':27B 'allow':9A 'api':93B,186C 'arbitrari':88B,181C 'attack':66B,160C 'autoprocessor':50B 'autoprocessor.from':137C 'client':41B,140C 'client-suppli':40B 'code':11A,43B,55B,62B,150C,156C 'control':6A,68B,161C 'cwe':30B 'descript':122C 'duplic':1A,95C,106C 'dynam':53B,148C 'enabl':64B,158C 'endpoint':85B,178C 'execut':12A,87B,180C 'extern':119C 'f623':15A,20A 'forward':38B,128C 'gc2m':112C 'ghsa':14A,19A,109C 'ghsa-f623-hjm8-5wg5':13A,18A 'ghsa-h3rc-6mm3-gc2m':108C 'h3rc':110C 'hjm8':16A,21A 'host':35B 'import':52B,152C 'infer':26B 'let':139C 'link':114C 'maintain':116C 'mm_processor_kwargs.code':7A,133C 'model':74B,146C,167C 'multimod':46B,79B,172C 'origin':121C 'preserv':118C 'pretrain':138C 'process':94B,187C 'processor':54B,149C 'python':32B,89B,182C 'refer':120C 'remot':10A,61B,155C 'repositori':75B,168C 'request':5A,47B,80B,131C,173C 'request-control':4A 'request-suppli':130C 'revis':8A,44B,58B,70B,134C,143C,163C 'select':141C 'self':34B 'self-host':33B 'send':77B,170C 'serv':73B,166C 'suppli':42B,132C 'tool':29B 'transform':49B,136C 'trust':60B,154C 'unauthent':83B,176C 'vllm':3A,23A,36B,37B,92B,123C,185C 'withdrawn':101C","nicknames":[],"mitigations":[],"who_affected":"Teams running vLLM between 0.7.3 and 0.31.0 with trust_remote_code enabled, serving models whose repository revisions could be attacker-controlled. The /tokenize endpoint is unauthenticated, so exposure to untrusted clients is the main risk. Deployments with trust_remote_code disabled or without network exposure can deprioritize this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T03:32:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f623-hjm8-5wg5","url":"https://github.com/advisories/GHSA-f623-hjm8-5wg5","severity":"critical","published_at":"2026-10-21T03:32:16+00:00","modified_at":"2026-10-27T15:36:11+00:00","first_seen_at":"2026-10-27T15:39:16+00:00","fetched_at":"2026-10-27T15:39:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}