vLLM affected by RCE via auto_map dynamic module loading during model initialization
Description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face auto_map dynamic modules during model resolution without gating on trust_remote_code, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vllmPyPI | >= 0.10.1, < 0.14.0 | 0.14.0 |
Affected products
1Patches
178d13ea9de4b[Model] Handle `trust_remote_code` for transformers backend (#32194)
2 files changed · +14 −1
vllm/model_executor/models/registry.py+2 −0 modified@@ -887,6 +887,7 @@ def _try_resolve_transformers( module, model_config.model, revision=model_config.revision, + trust_remote_code=model_config.trust_remote_code, warn_on_fail=False, ) @@ -899,6 +900,7 @@ def _try_resolve_transformers( module, model_config.model, revision=model_config.revision, + trust_remote_code=model_config.trust_remote_code, warn_on_fail=True, ) if model_module is not None:
vllm/transformers_utils/dynamic_module.py+12 −1 modified@@ -2,7 +2,10 @@ # SPDX-FileCopyrightText: Copyright contributors to the vLLM project import os -from transformers.dynamic_module_utils import get_class_from_dynamic_module +from transformers.dynamic_module_utils import ( + get_class_from_dynamic_module, + resolve_trust_remote_code, +) import vllm.envs as envs from vllm.logger import init_logger @@ -13,6 +16,7 @@ def try_get_class_from_dynamic_module( class_reference: str, pretrained_model_name_or_path: str, + trust_remote_code: bool, cache_dir: str | os.PathLike | None = None, force_download: bool = False, resume_download: bool | None = None, @@ -30,6 +34,13 @@ def try_get_class_from_dynamic_module( but ignoring any errors. """ try: + resolve_trust_remote_code( + trust_remote_code, + pretrained_model_name_or_path, + has_local_code=False, + has_remote_code=True, + ) + return get_class_from_dynamic_module( class_reference, pretrained_model_name_or_path,
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-2pc9-4j83-qjmrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-22807ghsaADVISORY
- github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/pull/32194ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/releases/tag/v0.14.0ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmrghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.