Executive brief
vLLM is a popular engine used to run and serve large language models (LLMs). A security flaw allows an attacker to execute malicious code on a server by tricking a user into loading a specially crafted model from a repository like HuggingFace. This could lead to a complete takeover of the server, theft of sensitive data, or disruption of AI services, particularly when the software is running in its optimized performance mode.
Technical details
A code injection vulnerability exists in vLLM's activation function loading mechanism within 'vllm/model_executor/layers/pooler/activations.py'. The software uses Python 'assert' statements to validate that activation functions are restricted to the 'torch.nn.modules' namespace. However, when Python is run in optimized mode (using the -O flag or PYTHONOPTIMIZE=1 environment variable), these assertions are removed at compile time. An attacker can exploit this by providing a malicious 'config.json' in a HuggingFace model that specifies an arbitrary Python function (import gadget) in the 'activation_fn' or 'sbert_ce_default_activation_function' fields. When the model is loaded, 'resolve_obj_by_qualname' imports and executes the attacker-specified function, leading to arbitrary code execution. This is fixed in version 0.22.0 by replacing assertions with explicit conditional exceptions.
Affected products
- vLLM Project vLLM < 0.22.0
Timeline
- 2026-04-02: disclosed: Initial report via huntr.com
- 2026-06-14: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date