CVE-2026-22807: vLLM affected by RCE via auto_map dynamic module loading during model initialization
Summary
vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup.
---
Impact
An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access.
---
Affected Versions
All versions where vllm/modelexecutor/models/registry.py resolves automap entries with trygetclassfromdynamicmodule without checking trustremotecode (at least current main).
---
Details
During model resolution, vLLM unconditionally iterates automap entries from the model config and calls trygetclassfromdynamicmodule, which delegates to Transformers’ getclassfromdynamicmodule and executes the module code.
This occurs even when trustremotecode is false, allowing a malicious model repo to embed code in a referenced module and have it executed during initialization.
Relevant code
- vllm/modelexecutor/models/registry.py:856 — automap resolution - vllm/transformersutils/dynamicmodule.py:13 — delegates to getclassfromdynamicmodule, which executes code
---
Fixes
https://github.com/vllm-project/vllm/pull/32194
Credits
Reported by bugbunny.ai
Other sources
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.14.0 - Upgrade
Upgrade
vllmto a version that resolves this vulnerability.Fixed in 0.14.0 - Compensating control
Ensure model loading uses a model repo/path you control (or otherwise disallow attacker-influenced local directories and remote Hugging Face repos) because vLLM can execute attacker-controlled Python code embedded in referenced auto_map dynamic modules during model initialization.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22807?
CVE-2026-22807 has been rated as high severity due to its potential for remote code execution.
How do I fix CVE-2026-22807?
To mitigate CVE-2026-22807, update vLLM to version 0.14.0 or later which addresses the vulnerability by ensuring proper trust gating.
Who is affected by CVE-2026-22807?
Users of vLLM versions between 0.10.1 and 0.14.0 are affected by CVE-2026-22807.
What impact does CVE-2026-22807 pose?
CVE-2026-22807 allows attacker-controlled Python code to execute on the server, which can lead to data breaches and server compromises.
When was CVE-2026-22807 disclosed?
CVE-2026-22807 was disclosed as a security vulnerability in 2026.