vLLM: request-controllable mm_processor_kwargs.code_revision allows remote code execution
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
A GitHub security advisory disclosed a remote code execution vulnerability in vLLM (CVE-2026-114053): an untrusted multimodal request can set mm_processor_kwargs.code_revision; when the Hugging Face processor of the served model uses dynamic auto_map code and the operator enables --trust-remote-code, this value is passed to AutoProcessor.from_pretrained, letting the client replace the operator-reviewed processor code with a revision it controls in the same model repository, and importing the Python module executes arbitrary code in the vLLM API/renderer process, while the model and data revisions remain at the operator-fixed values. Configurations with the default trust_remote_code=False are not affected; according to the advisory's structured fields, affected versions are 0.7.3 and above and before 0.31.0, and it has been fixed in 0.31.0.
The advisory provides trigger conditions and root cause analysis; operators deploying vLLM multimodal services with trust_remote_code enabled can use it to check their configurations and upgrade to 0.31.0.