vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting c

Summary

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.

Remediation

1. Inventory every Vllm Vllm deployment, including staging.
2. Upgrade Vllm Vllm to 0.31.0.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/vllm-project/vllm/commit/570735520942b6428ae98f1eb442c6d88adae55e
• Advisoryhttps://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m
• Advisoryhttps://www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision