Executive brief
vLLM is a high-performance engine for serving artificial intelligence models. A security vulnerability in its distributed communication component allows an attacker to execute arbitrary commands on the server. This could lead to a total system takeover, theft of sensitive AI models or data, and disruption of operations.
Technical details
A remote code execution (RCE) vulnerability exists in vLLM's PyNcclPipe service due to the use of the 'pickle' library to deserialize untrusted data. The vulnerability is located in the _recv_metadata method, which calls pickle.loads on data received over the network. While intended for private network use, the underlying PyTorch TCPStore component defaults to listening on all network interfaces (0.0.0.0), potentially exposing the service to the public internet or untrusted local networks. An unauthenticated attacker can send a maliciously crafted serialized object to the PyNcclPipe port (default 18888) to execute arbitrary code with the privileges of the vLLM process. This issue is fixed in version 0.8.5 by forcing the TCPStore to bind only to the specified private interface.
Affected products
- vLLM Project vllm >= 0.6.5, < 0.8.5
Timeline
- 2025-05-20: advisory
- 2025-05-20: disclosed
- 2025-05-20: patched: Fixed in version 0.8.5