VYPR
High severityOSV Advisory· Published Jan 21, 2026· Updated Jan 22, 2026

vLLM affected by RCE via auto_map dynamic module loading during model initialization

CVE-2026-22807

Description

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face auto_map dynamic modules during model resolution without gating on trust_remote_code, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
vllmPyPI
>= 0.10.1, < 0.14.00.14.0

Affected products

1

Patches

1
78d13ea9de4b

[Model] Handle `trust_remote_code` for transformers backend (#32194)

https://github.com/vllm-project/vllmCyrus LeungJan 13, 2026via ghsa
2 files changed · +14 1
  • vllm/model_executor/models/registry.py+2 0 modified
    @@ -887,6 +887,7 @@ def _try_resolve_transformers(
                             module,
                             model_config.model,
                             revision=model_config.revision,
    +                        trust_remote_code=model_config.trust_remote_code,
                             warn_on_fail=False,
                         )
     
    @@ -899,6 +900,7 @@ def _try_resolve_transformers(
                             module,
                             model_config.model,
                             revision=model_config.revision,
    +                        trust_remote_code=model_config.trust_remote_code,
                             warn_on_fail=True,
                         )
                         if model_module is not None:
    
  • vllm/transformers_utils/dynamic_module.py+12 1 modified
    @@ -2,7 +2,10 @@
     # SPDX-FileCopyrightText: Copyright contributors to the vLLM project
     import os
     
    -from transformers.dynamic_module_utils import get_class_from_dynamic_module
    +from transformers.dynamic_module_utils import (
    +    get_class_from_dynamic_module,
    +    resolve_trust_remote_code,
    +)
     
     import vllm.envs as envs
     from vllm.logger import init_logger
    @@ -13,6 +16,7 @@
     def try_get_class_from_dynamic_module(
         class_reference: str,
         pretrained_model_name_or_path: str,
    +    trust_remote_code: bool,
         cache_dir: str | os.PathLike | None = None,
         force_download: bool = False,
         resume_download: bool | None = None,
    @@ -30,6 +34,13 @@ def try_get_class_from_dynamic_module(
         but ignoring any errors.
         """
         try:
    +        resolve_trust_remote_code(
    +            trust_remote_code,
    +            pretrained_model_name_or_path,
    +            has_local_code=False,
    +            has_remote_code=True,
    +        )
    +
             return get_class_from_dynamic_module(
                 class_reference,
                 pretrained_model_name_or_path,
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.