Pierreolivierbonin

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.22.0 **Description** An assert-based security check in the activation function loading process allows an unauthenticated attacker to achieve arbitrary code execution on the server. This occurs when vLLM is run in Python optimized mode (`python -O` or `PYTHONOPTIMIZE=1`), as Python strips `assert` statements at compile time in this mode. An attacker can exploit this by publishing a malicious HuggingFace model with a crafted `config.json`. The attacker-controlled `function name` is passed to the `resolve obj by qualname()` function, which acts as an unrestricted import gadget, executing arbitrary code during model initialization with the privileges of the vLLM process. The vulnerable parameters within the model's `config.json` are `config.sentence transformers["activation fn"]` and `config.sbert ce default activation function`. **Recommendations** Update to version 0.22.0. As a temporary workaround, avoid running vLLM in Python optimized mode (`python -O` or `PYTHONOPTIMIZE=1`) when loading models from untrusted sources.