CVE-2026-100653
Received Received - Intake

Incorrect Revision Pin Propagation in vLLM for FunAudioChat and Tarsier2

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100653
EUVD
EUVD-2026-87747

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vllm_project vllm From 0.22.1 (inc) to 0.28.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects vLLM versions 0.22.1 through 0.28.0. It involves the operator-supplied model revision pin (--revision / --code-revision) not being properly propagated to certain Hugging Face artifact loads for FunAudioChat and Tarsier2 architectures. Specifically, the WhisperFeatureExtractor, speech_tokenizer, and Qwen2VLConfig.from_pretrained calls do not respect the pinned revision, allowing deployments to load artifacts from the repository's default revision instead. This can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration if the upstream default branch changes.

Detection Guidance

To detect this vulnerability, check if your vLLM deployment uses versions 0.22.1 through 0.28.0. Inspect the model loading paths in vllm/model_executor/models/funaudiochat.py and vllm/model_executor/models/qwen2_vl.py for missing revision pin propagation. Commands like grep -r "from_pretrained" /path/to/vllm/model_executor/models/ can help identify affected artifact loads.

Impact Analysis

This vulnerability can impact you by causing unexpected changes in model behavior for deployments pinned to a specific revision. If the upstream default branch of the model artifacts changes, your pinned deployment might load newer versions of processors, tokenizers, or configs, altering audio preprocessing, speech tokenization, or model configuration without your knowledge. This undermines reproducibility and supply-chain integrity.

Mitigation Strategies

Upgrade vLLM to version 0.28.0 or later to resolve the issue. Ensure all model loading calls in FunAudioChat and Tarsier2 paths explicitly pass the revision parameter to from_pretrained calls. Review deployment configurations to confirm revision pins are enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart