{"schema":"threatline.record/2","record":{"id":"CVE-2026-100653","aliases":["GHSA-hhv2-872h-628q"],"summary":"vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation","details":"vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.","categories":["Unclassified"],"product":"vllm","vendor":"vllm-project","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100653","source_modified_at":"2026-10-01T11:06:45.139Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"vllm","vendor":"vllm-project","versions":[{"version":"0.22.1","status":"affected","versionType":"semver","lessThan":"0.28.0"},{"version":"0.28.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100653","source_modified_at":"2026-10-01T11:06:45.139Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"vllm","ecosystem":null},"version":"0.28.0","basis":"first unaffected version stated in the CVE record"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00275,"percentile":0.18892,"score_date":"2026-10-23"},"published_at":"2026-09-26T13:23:22.605Z","modified_at":"2026-10-01T11:06:45.139Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100653","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T11:06:45.139Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100653","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T17:46:29.258369Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T11:06:45.139Z","content_hash":"be7ad4bd989b38d3aa91fe06dbad94df5d091a12e0bc69e941ca9fd2bbc31850"}}