All vulnerabilities
CVE-2026-114053GHSA-h3rc-6mm3-gc2m

vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

vllm-project vllm
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.31.0Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.

Text from CVE List

Affected versions 2

  • vllmaffected: 0.7.3 before 0.31.0CVE List
  • vllmunaffected: 0.31.0CVE List

References 3