High severityNVD Advisory· Published Jan 27, 2025· Updated Feb 12, 2025
vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator
CVE-2025-24357
Description
vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weights_only parameter defaults to False. When torch.load loads malicious pickle data, it will execute arbitrary code during unpickling. This vulnerability is fixed in v0.7.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vllmPyPI | < 0.7.0 | 0.7.0 |
Affected products
1Patches
1d3d6bb13fb62Set weights_only=True when using torch.load() (#12366)
4 files changed · +10 −6
vllm/assets/image.py+1 −1 modified@@ -26,4 +26,4 @@ def image_embeds(self) -> torch.Tensor: """ image_path = get_vllm_public_assets(filename=f"{self.name}.pt", s3_prefix=VLM_IMAGES_DIR) - return torch.load(image_path, map_location="cpu") + return torch.load(image_path, map_location="cpu", weights_only=True)
vllm/lora/models.py+2 −1 modified@@ -273,7 +273,8 @@ def from_local_checkpoint( new_embeddings_tensor_path) elif os.path.isfile(new_embeddings_bin_file_path): embeddings = torch.load(new_embeddings_bin_file_path, - map_location=device) + map_location=device, + weights_only=True) return cls.from_lora_tensors( lora_model_id=get_lora_id()
vllm/model_executor/model_loader/weight_utils.py+5 −3 modified@@ -93,7 +93,7 @@ def convert_bin_to_safetensor_file( pt_filename: str, sf_filename: str, ) -> None: - loaded = torch.load(pt_filename, map_location="cpu") + loaded = torch.load(pt_filename, map_location="cpu", weights_only=True) if "state_dict" in loaded: loaded = loaded["state_dict"] shared = _shared_pointers(loaded) @@ -381,7 +381,9 @@ def np_cache_weights_iterator( disable=not enable_tqdm, bar_format=_BAR_FORMAT, ): - state = torch.load(bin_file, map_location="cpu") + state = torch.load(bin_file, + map_location="cpu", + weights_only=True) for name, param in state.items(): param_path = os.path.join(np_folder, name) with open(param_path, "wb") as f: @@ -447,7 +449,7 @@ def pt_weights_iterator( disable=not enable_tqdm, bar_format=_BAR_FORMAT, ): - state = torch.load(bin_file, map_location="cpu") + state = torch.load(bin_file, map_location="cpu", weights_only=True) yield from state.items() del state torch.cuda.empty_cache()
vllm/prompt_adapter/utils.py+2 −1 modified@@ -89,6 +89,7 @@ def load_peft_weights(model_id: str, adapters_weights = safe_load_file(filename, device=device) else: adapters_weights = torch.load(filename, - map_location=torch.device(device)) + map_location=torch.device(device), + weights_only=True) return adapters_weights
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- github.com/advisories/GHSA-rh4j-5rhw-hr54ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-24357ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2025-58.yamlghsaWEB
- github.com/vllm-project/vllm/commit/d3d6bb13fb62da3234addf6574922a4ec0513d04ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/pull/12366ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/releases/tag/v0.7.0ghsaWEB
- github.com/vllm-project/vllm/security/advisories/GHSA-rh4j-5rhw-hr54ghsax_refsource_CONFIRMWEB
- pytorch.org/docs/stable/generated/torch.load.htmlghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.