CVE-2026-22807
Summary
vLLM loads Hugging Face auto_map dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup.
---
Impact
An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load.
This happens before any request handling and does not require API access.
---
Affected Versions
All versions where vllm/model_executor/models/registry.py resolves auto_map entries with trygetclassfromdynamic_module without checking trustremotecode (at least current main).
---
Details
During model resolution, vLLM unconditionally iterates auto_map entries from the model config and calls trygetclassfromdynamic_module, which delegates to Transformers’ getclassfromdynamicmodule and executes the module code.
This occurs even when trustremotecode is false, allowing a malicious model repo to embed code in a referenced module and have it executed during initialization.
Relevant code
vllm/model_executor/models/registry.py:856— auto_map resolutionvllm/transformersutils/dynamicmodule.py:13— delegates togetclassfromdynamicmodule, which executes code
---
Fixes
- https://github.com/vllm-project/vllm/pull/32194
Credits
Reported by bugbunny.ai
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version
Related Resources
References
https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr, https://nvd.nist.gov/vuln/detail/CVE-2026-22807, https://github.com/vllm-project/vllm/pull/32194, https://github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5, https://github.com/vllm-project/vllm, https://github.com/vllm-project/vllm/releases/tag/v0.14.0
Basic Information
