CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2026-22807
Critical (9.8) in vllm vllm. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in vllm 0.14.0.
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vllm:vllm
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2pc9-4j83-qjmr | PyPI | vllm | >=0.10.1 <0.14.0 | 0.14.0 |
| PYSEC-2026-2010 | PyPI | vllm | >=0.10.1 <0.14.0 | 0.14.0 |
References
- https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5
- https://github.com/vllm-project/vllm/pull/32194
- https://github.com/vllm-project/vllm/releases/tag/v0.14.0
- https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr
- https://access.redhat.com/errata/RHSA-2026:10184