PT-2026-50140 · Vllm · Vllm
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
vLLM versions prior to 0.22.0
Description
An assert-based security check in the activation function loading process allows an unauthenticated attacker to achieve arbitrary code execution on the server. This occurs when vLLM is run in Python optimized mode (
python -O or PYTHONOPTIMIZE=1), as Python strips assert statements at compile time in this mode. An attacker can exploit this by publishing a malicious HuggingFace model with a crafted config.json. The attacker-controlled function name is passed to the resolve obj by qualname() function, which acts as an unrestricted import gadget, executing arbitrary code during model initialization with the privileges of the vLLM process.The vulnerable parameters within the model's
config.json are config.sentence transformers["activation fn"] and config.sbert ce default activation function.Recommendations
Update to version 0.22.0.
As a temporary workaround, avoid running vLLM in Python optimized mode (
python -O or PYTHONOPTIMIZE=1) when loading models from untrusted sources.Exploit
Fix
Assertion Failure
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vllm