vLLM: untrusted EPS input can trigger denial of service or Ghostscript remote code execution
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
A GitHub security advisory disclosed that in vLLM versions before 0.32.0, an EPS payload labeled as image/png can reach the host Ghostscript through the image loading path, because ImageMediaIO hands attacker-controllable image bytes to Pillow's format auto-detection, and the requested MIME label does not constrain decoder selection. When the host Ghostscript is affected by CVE-2024-29510, an attacker can use this known sandbox escape to execute commands with the privileges of the vLLM process; the advisory authors reproduced loader-level command execution using PyPI vllm==0.30.0, Pillow 12.3.0 and Debian Ghostscript 10.03.0, while the HTTP request path was only source-traced and not verified end to end. Exploitation also requires that the caller can access the image request path through the deployed authentication policy; the fix has been merged in MR60022, and the fixed version is 0.32.0.
The advisory gives the exploitation chain from image input to Ghostscript sandbox escape and the reproduction conditions, which deployments of vLLM multimodal services can use to check host dependencies and access controls.