Advisory details:
pypa / vllm/PYSEC-2026-2010
| Advisory ID | pypa/vllm/PYSEC-2026-2010 |
| Aliases |
CVE-2026-22807
GHSA-2pc9-4j83-qjmr PYSEC-2026-2010 |
| Summary | vLLM affected by RCE via auto_map dynamic module loading during model initialization # Summary vLLM loads Hugging Face `auto_map` dynamic modules during model resolution **without gating on `trust_remote_code`**, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- # Impact An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve **arbitrary code execution** on the vLLM host during model load. This happens **before any request handling** and does **not require API access**. --- # Affected Versions All versions where `vllm/model_executor/models/registry.py` resolves `auto_map` entries with `try_get_class_from_dynamic_module` **without checking `trust_remote_code`** (at least current `main`). --- # Details During model resolution, vLLM unconditionally iterates `auto_map` entries from the model config and calls `try_get_class_from_dynamic_module`, which delegates to Transformers’ `get_class_from_dynamic_module` and **executes the module code**. This occurs even when `trust_remote_code` is `false`, allowing a malicious model repo to embed code in a referenced module and have it executed during initialization. ### Relevant code - `vllm/model_executor/models/registry.py:856` — auto_map resolution - `vllm/transformers_utils/dynamic_module.py:13` — delegates to `get_class_from_dynamic_module`, which executes code --- # Fixes * https://github.com/vllm-project/vllm/pull/32194 # Credits Reported by **bugbunny.ai** |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.9 |
| Risk | 4.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.8 | https://github.com/pypa/advisory-database/blob/main/vulns/vllm/PYSEC-2026-2010.yaml |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-01-22T15:11:00Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22807.json
Source Advisory: vulnrichment/CVE-2026-22807
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]