vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5 | Patch |
| https://github.com/vllm-project/vllm/pull/32194 | Issue Tracking Patch |
| https://github.com/vllm-project/vllm/releases/tag/v0.14.0 | Product Release Notes |
| https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr | Patch Vendor Advisory |
Configurations
History
30 Jan 2026, 14:43
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* | |
| References | () https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5 - Patch | |
| References | () https://github.com/vllm-project/vllm/pull/32194 - Issue Tracking, Patch | |
| References | () https://github.com/vllm-project/vllm/releases/tag/v0.14.0 - Product, Release Notes | |
| References | () https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr - Patch, Vendor Advisory | |
| First Time |
Vllm
Vllm vllm |
21 Jan 2026, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-21 22:15
Updated : 2026-01-30 14:43
NVD link : CVE-2026-22807
Mitre link : CVE-2026-22807
CVE.ORG link : CVE-2026-22807
JSON object : View
Products Affected
vllm
- vllm
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')