CVE-2026-100653: vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

Published Sep 26, 2026
·
Updated

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speechtokenizer PreTrainedTokenizerFast loads in vllm/modelexecutor/models/funaudiochat.py and the Qwen2VLConfig.frompretrained call used by Tarsier2ProcessingInfo in vllm/modelexecutor/models/qwen2vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trustremotecode=False bypass. The issue is fixed in version 0.28.0.

Affected Software

1 affected component
vllm vllm>=0.22.1<0.28.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade vLLM to a version that resolves this vulnerability.

    Fixed in 0.28.0

Event History

Sep 26, 2026
CVE Published
via MITRE·01:23 PM
Data Sourced
via MITRE·01:23 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are affected?

Affected deployments use vLLM versions from 0.22.1 through 0.28.0 and load the FunAudioChat or Tarsier2 architectures. The issue matters when an operator supplies a model revision pin with --revision or --code-revision and expects all related artifacts to use that reviewed revision.

2

What would need to happen for this issue to have an effect?

A behavior-affecting processor, tokenizer, or configuration artifact on the upstream repository's default revision would need to change after the operator selected their pin. The unpinned loads can then resolve that default-revision artifact despite the configured model revision pin.

3

Does this allow remote code execution or bypass trust_remote_code=False?

No. The issue is described as a supply-chain integrity and reproducibility failure and does not constitute remote code execution or a trust_remote_code=False bypass.

4

What is the remediation?

Upgrade to vLLM 0.28.0, which fixes the incomplete artifact-pin propagation. Until then, deployments relying on reviewed revision pins should recognize that the affected FunAudioChat and Tarsier2 artifact loads may still follow the upstream default revision.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203