PT-2026-60020 · Pypi · Vllm

Publicado

2026-07-13

·

Atualizado

2026-07-13

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image grid thw/video grid thw are affected. Severity: High (remote DoS). Reproduced on vLLM 0.10.0 with Qwen2.5-VL.

Details

  • Affected component: multimodal input position computation.
  • File/functions (paths are indicative):
  • vllm/model executor/layers/rotary embedding.py
  • get input positions tensor(...)
  • vl get input positions tensor(...)
  • Failure mechanism:
  • The code counts detected vision tokens and then indexes video grid thw/image grid thw accordingly.
  • When user input carries placeholder tokens but no actual multimodal payload, these grids are empty. The code does not bounds-check before indexing.
Representative snippet (context):
python
# vllm/model executor/layers/rotary embedding.py
@classmethod
def vl get input positions tensor(
  cls,
  input tokens,
  hf config,
  image grid thw,
  video grid thw,
  ...,
):
  # detect video tokens
  video nums = (vision tokens == video token id).sum()
  # later in processing
  t, h, w = (
    video grid thw[video index][0], # IndexError if no video data
    video grid thw[video index][1],
    video grid thw[video index][2],
  )
Abbreviated call path:
OpenAI API request
 → vllm.v1.engine.core: step/execute model
 → vllm.v1.worker.gpu model runner: update states/execute model
 → vllm.model executor.layers.rotary embedding: get input positions tensor
 → vl get input positions tensor
 → IndexError: list index out of range

PoC

Environment

  • vLLM: 0.10.0
  • Model: Qwen/Qwen2.5-VL-3B-Instruct
  • Launch server:
bash
python -m vllm.entrypoints.openai.api server 
 --model Qwen/Qwen2.5-VL-3B-Instruct 
 --port 8000

Request (text-only, no image/video data)

bash
cat > request.json <<'JSON'
{
 "model": "Qwen/Qwen2.5-VL-3B-Instruct",
 "messages": [
  {
   "role": "user",
   "content": [
    { "type": "text",
     "text": "what's in picture <|vision start|><|image pad|><|vision end|>" }
   ]
  }
 ]
}
JSON

curl -s http://127.0.0.1:8000/v1/chat/completions 
 -H 'Content-Type: application/json' 
 --data @request.json

Observed result

  • HTTP 500; logs show IndexError: list index out of range from vl get input positions tensor(...).
  • In some deployments, the worker exits and capacity remains reduced until manual restart.

Impact

  • Type: Token Injection leading to Remote Denial of Service (unauthenticated). A single request can trigger the fault.
  • Scope: Any vLLM deployment that serves VLMs and accepts raw user text via OpenAI-compatible endpoints (self-hosted or proxied/managed fronts).
  • Effect: Request → unhandled exception in position computation → worker termination / service unavailability.

Fixes

Credits

Pengyu Ding (Infra Security, Ant Group) Ziteng Xu (Infra Security, Ant Group)

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-3409

Produtos afetados

Vllm