Description
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | 0.7.3 – < 0.31.0 | 0.31.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vllm | >= 0.7.3, < 0.31.0 | 0.31.0 | GHSA-h3rc-6mm3-gc2m |
Advisories 1
- WID-SEC-2026-4076 vllm: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
References
- GitHub Security Advisory (GHSA-h3rc-6mm3-gc2m) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision third-party-advisory