Executive brief
vLLM, a high-throughput engine for serving AI models, is vulnerable to a security flaw that allows for unauthorized code execution. By providing a specially crafted AI model repository, an attacker can force the server to run malicious Python code during the initial setup process. This occurs before the server even begins processing user requests and can lead to a full system compromise or data theft.
Technical details
A code injection vulnerability exists in vLLM's model resolution logic within `vllm/model_executor/models/registry.py`. The application unconditionally iterates through `auto_map` entries in a model's configuration and invokes `try_get_class_from_dynamic_module`, which eventually executes arbitrary Python code via the Transformers library. This execution occurs even if `trust_remote_code` is set to false. An attacker who can influence the model repository path (either locally or via a remote Hugging Face repo) can achieve arbitrary code execution on the host at server startup. The issue is fixed in version 0.14.0.
Affected products
- vllm-project vllm >= 0.10.1, < 0.14.0
Timeline
- 2026-01-21: disclosed
- 2026-01-21: advisory
- 2026-01-21: patched: Fixed in version 0.14.0