AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

vLLMGHSA-2pc9-4j83-qjmr

vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM

CVE-2026-22807 · Published Jan 21, 2026 · updated Sep 10, 2026

High8.8
Fix: upgrade to 0.14.0 or later
GitHub advisory

Summary

vLLM loads Hugging Face auto_map dynamic modules during model resolution **without gating on trust_remote_code**, allowing attacker-controlled Python code in a model repo/path to execute at server startup.

---

Impact

An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load.

This happens before any request handling and does not require API access.

---

Affected Versions

All versions where vllm/model_executor/models/registry.py resolves auto_map entries with try_get_class_from_dynamic_module **without checking trust_remote_code** (at least current main).

---

Details

During model resolution, vLLM unconditionally iterates auto_map entries from the model config and calls try_get_class_from_dynamic_module, which delegates to Transformers’ get_class_from_dynamic_module and executes the module code.

This occurs even when trust_remote_code is false, allowing a malicious model repo to embed code in a referenced module and have it executed during initialization.

Relevant code

  • vllm/model_executor/models/registry.py:856 , auto_map resolution
  • vllm/transformers_utils/dynamic_module.py:13 , delegates to get_class_from_dynamic_module, which executes code

---

Fixes

*...

Affected versions

PackageAffectedFixed in
vllm
PyPI
>= 0.10.1, < 0.14.00.14.0
Details and references

# Summary vLLM loads Hugging Face `auto_map` dynamic modules during model resolution **without gating on `trust_remote_code`**, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- # Impact An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve **arbitrary code execution** on the vLLM host during model load. This happens **before any request handling** and does **not require API access**. --- # Affected Versions All versions where `vllm/model_executor/models/registry.py` resolves `auto_map` entries with `try_get_class_from_dynamic_module` **without checking `trust_remote_code`** (at least current `main`). --- # Details During model resolution, vLLM unconditionally iterates `auto_map` entries from the model config and calls `try_get_class_from_dynamic_module`, which delegates to Transformers’ `get_class_from_dynamic_module` and **executes the module code**. This occurs even when `trust_remote_code` is `false`, allowing a malicious model repo to embed code in a referenced module and have it executed during initialization. ### Relevant code - `vllm/model_executor/models/registry.py:856` , auto_map resolution - `vllm/transformers_utils/dynamic_module.py:13` , delegates to `get_class_from_dynamic_module`, which executes code --- # Fixes * https://github.com/vllm-project/vllm/pull/32194 # Credits Reported by **bugbunny.ai**

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94
Also known as
CVE-2026-22807, PYSEC-2026-2010

More vLLM advisories

All vLLM
Medium 5.4Mar 9vLLM has SSRF Protection BypassCVE-2026-25960fixed in 0.17.0Critical 9.8Feb 2vLLM has RCE In Video ProcessingCVE-2026-22778fixed in 0.14.1High 7.1Jan 28vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnectorCVE-2026-24779fixed in 0.14.1Medium 6.5Jan 13vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensionsCVE-2026-22773fixed in 0.12.0High 8.8Jan 8vLLM introduced enhanced protection for CVE-2025-62164CVE-2026-56340fixed in 0.13.0High 7.1Dec 2, 2025vLLM vulnerable to remote code execution via transformers_utils/get_configCVE-2025-66448fixed in 0.11.1