CVE-2026-114053

Overview

vLLM versions 0.7.3 through 0.30.9 allow an attacker to specify a code revision that is loaded by the Transformers AutoProcessor when trust_remote_code is enabled. This can lead to arbitrary Python execution via the unauthenticated /tokenize endpoint. The flaw affects any deployment of vLLM that accepts external model revisions.

Description

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.

Impact

Confidentiality: attacker may execute arbitrary code and access sensitive data. Integrity: malicious code can modify or delete processed data. Availability: code execution could crash or destabilize the service. Defenders: system administrators, DevOps teams, and security operations personnel.

Remediation

Upgrade vLLM to 0.31.0 or later. Disable trust_remote_code or set it to False. Remove or validate mm_processor_kwargs.code_revision in requests. Secure the /tokenize endpoint with authentication or rate limiting. Monitor logs for unexpected code execution.

Risk context

High severity (CVSS 8.1). No EPSS data available. Immediate patching recommended to prevent arbitrary code execution.

Affected products

• vLLM
• vLLM API
• vLLM 0.7.3-0.30.9
• vLLM 0.31.0
• vLLM 0.32.0
• vLLM 0.33.0
• vLLM 0.34.0
• vLLM 0.35.0