Advisory details:
vulnrichment / CVE-2025-66448
| Advisory ID | vulnrichment/CVE-2025-66448 |
| Aliases | |
| Summary | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.1 | |
| ssvc | Track |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/vllm-project/vllm/commit/ffb08379d8870a1a81ba82b72797f196838d0c86 | ||
| https://github.com/vllm-project/vllm/pull/28126 | ||
| GHSA-8fr4-5q9j-m8gm | https://github.com/vllm-project/vllm/security/advisories/GHSA-8fr4-5q9j-m8gm |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-12-02T14:14:49Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/66xxx/CVE-2025-66448.json
Source Advisory: vulnrichment/CVE-2025-66448
[{'Exploitation': 'none'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]