CVE-2026-114053

LOWCVSS 9.2 · CRITICAL

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Upwind Security MDR@UpwindMDR19h
🚨High - vLLM RCE via AutoProcessor code_revision Injection (CVE-2026-114053) vLLM forwards client-supplied mm_processor_kwargs.code_revision into Transformers AutoProcessor.from_pretrained when trust_remote_code is enabled, letting attackers pick a malicious model revision whose dynamic processor code is imported. If the attacker controls a revision in the served model repo, a multimodal request to the unauthenticated /tokenize endpoint yields arbitrary Python code execution in the API process. 👉Affected: vllm >= 0.7.3, < 0.31.0 | Upgrade to 0.31.0
00010386
342 followersView on X

Explore more

Back to dashboard