Remote Code Execution in vLLM via Arbitrary Revision Selection

Executive Summary

CVE-2026-114053 is a remote code execution vulnerability in the vLLM library. It occurs when a request-controlled parameter, mm_processor_kwargs.code_revision, is passed to Transformers' AutoProcessor.from_pretrained function. If trust_remote_code is enabled, this allows an attacker to execute arbitrary Python code in the vLLM API process by sending a crafted multimodal request to the unauthenticated /tokenize endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check if your vLLM version is between 0.7.3 and 0.31.0 by running: pip show vllm. If enabled, verify if --trust-remote-code is set in vLLM server startup. Inspect network traffic for unauthenticated requests to the /tokenize endpoint. Monitor for unexpected Python code execution in vLLM processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary code in the vLLM API process without needing a GPU, model weights, or repository changes. It can lead to full system compromise, data theft, or service disruption. The attack is possible even with authentication enabled since the /tokenize endpoint remains unauthenticated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized processing, or disclosure of protected health information, leading to legal penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.31.0 or later immediately. Disable --trust-remote-code if enabled. Restrict access to the /tokenize endpoint by enabling authentication. Ensure the model repository does not allow untrusted revisions. Monitor for suspicious activity in vLLM processes.

Useful 0 Not Useful 0