Executive brief
vLLM is an engine used to run and serve large language models (LLMs). A flaw in how it handles versioning allows the system to download and run unverified components—such as model weights or code—even when an administrator has specified a specific, "pinned" version for security review. This creates a supply-chain risk where a trusted model could unknowingly execute updated or malicious files from an unreviewed version, potentially compromising the integrity of the AI service.
Technical details
A supply-chain integrity vulnerability exists in vLLM due to 'artifact pin decay.' When an operator specifies a model version using --revision or --code-revision, the pinning logic is not consistently propagated to all secondary artifact load paths. Specifically, components like GGUF files, image processors, and secondary weights (e.g., in Kimi-Audio or BGE-M3 models) may resolve to the repository's default branch instead of the pinned revision. This allows for the execution of unreviewed dynamic code or the loading of unverified weights. The issue was addressed in version 0.22.0 by ensuring revision pins are passed to all internal artifact boundaries, including hf_hub_download and dynamic module loaders.
Affected products
- vllm-project vLLM < 0.22.0
Timeline
- 2026-05-14: other: Pull request for fix submitted
- 2026-05-15: patched: Fix merged into main branch
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD