PT-2025-48580 · Vllm · Vllm

Published

2025-12-01

·

Updated

2025-12-09

·

CVE-2025-66448

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.11.1
Description vLLM is an inference and serving engine for large language models (LLMs). A critical issue exists in the Nemotron Nano VL Config class where remote code execution can occur. When vLLM loads a model configuration containing an auto map entry, the get class from dynamic module() function is used to resolve the mapping and instantiate the returned class. This process retrieves and executes Python code from the remote repository specified in the auto map string, even if trust remote code is set to False within vllm.transformers utils.config.get config. An attacker can leverage this by publishing a seemingly harmless frontend repository with a config.json file that points to a malicious backend repository. Loading the frontend then silently executes the backend’s code on the victim system. The vulnerable component is the get class from dynamic module() function.
Recommendations Versions prior to 0.11.1 should be updated to version 0.11.1 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-66448
GHSA-8FR4-5Q9J-M8GM

Affected Products

Vllm