GHSA-f623-hjm8-5wg5
Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
Summary
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references. ## Original Description vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| PyPI | vllm | — | 0.31.0 |
Remediation: Upgrade to 0.31.0 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.