vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
CVE-2026-114053
Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision imported by Transformers. This lets a client replace the operator-reviewed processor module with code from another revision of the same model repository. The operator-selected model/data revision remains pinned; only the executed processor code changes. Importing a Python module is arbitrary code execution in the vLLM API/renderer process. The PoC below demonstrates this with an import-time filesystem write. It is fully offline and does not require a GPU, model weights, or changes to a real Hub repository. Affected snapshot Repository: [vllm-project/vllm](https://github.com/vllm-project/vllm) Verified commit: [570735520942b6428ae98f1eb442c6d88adae55e](https://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e) Verified with Transformers 5.15.0 and 5.16.1 Affected release range has not been bisected Affected configuration The vulnerable path exists when all of the…
Part of the AI stack
This affects vLLM, in Inference & serving.
Assessment
- CVSS
- 8.1 (v3.1)
- Severity
- High
- EPSS
- 0.00462% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Affected
- pip · vllm
- Weakness
- CWE-829, CWE-94
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m
- https://github.com/vllm-project/vllm/pull/58830
- https://github.com/vllm-project/vllm/commit/31f2e70cd3e403aaa471fb7fe3d33a7207aaf3cc
- https://github.com/vllm-project/vllm/releases/tag/v0.31.0
- https://nvd.nist.gov/vuln/detail/cve-2026-114053
- https://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision
- https://github.com/advisories/GHSA-h3rc-6mm3-gc2m
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-114053