PT-2026-3865 · Hugging Face+1 · Hugging Face Auto Map+1

Arthurgervais + 1 · Published 2026-01-21 · Updated 2026-01-30 · CVE-2026-22807

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vLLM versions 0.10.1 through 0.13.x

Description vLLM is an inference and serving engine for large language models (LLMs). The software loads Hugging Face

auto map

dynamic modules during model resolution without verifying

trust remote code

. This allows attacker-controlled Python code within a model repository or path to execute when the server starts. An attacker who can control the model repository or path can achieve arbitrary code execution on the vLLM host during model loading. This occurs before any request handling and does not require API access. The

auto map

resolution in

vllm/model executor/models/registry.py

and the execution of code through

get class from dynamic module

in

vllm/transformers utils/dynamic module.py

are relevant to this issue.

Recommendations Upgrade to vLLM version 0.14.0 or later. Audit any custom Hugging Face models loaded in your ML pipeline.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-22807

GHSA-2PC9-4J83-QJMR

Affected Products

Hugging Face Auto Map

Vllm

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22807.json · Exploit
• https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr · Vendor Advisory
• https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5 · Patch
• https://github.com/vllm-project/vllm/pull/32194 · Patch
• https://osv.dev/vulnerability/GHSA-2pc9-4j83-qjmr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22807 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22807 · Vendor Advisory
• https://github.com/vllm-project/vllm · Note
• https://github.com/vllm-project/vllm/releases/tag/v0.14.0 · Note
• https://twitter.com/HatforceSec/status/2014022938819748291 · Twitter Post
• https://twitter.com/CveFindCom/status/2014128266014076937 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014133348541587665 · Twitter Post
• https://twitter.com/HatforceSec/status/2014265936853795116 · Twitter Post
• https://twitter.com/CVEnew/status/2014091836634136706 · Twitter Post
• https://t.me/cveNotify/150404 · Telegram Post