Remote Code Execution in vLLM via LlavaOnevision2 Processor

Executive Summary

This vulnerability affects vLLM versions before 0.28.0 in the LlavaOnevision2 processor loader. The issue is that the loader ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

Useful 0 Not Useful 0

Detection Guidance

Check vLLM version with pip show vllm. If version is below 0.28.0, the system is vulnerable. Inspect model loading logs for LlavaOnevision2 processor for unexpected code execution attempts or errors related to processing_llava_onevision2.py or video_processing_llava_onevision2.py.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code with the full authority of the vLLM process. This could lead to complete system compromise, data theft, or unauthorized access. The impact includes high confidentiality, integrity, and availability loss as the malicious code runs with the same privileges as the vLLM application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to severe compliance violations under GDPR and HIPAA due to unauthorized code execution and potential data breaches. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. Exploitation could result in unauthorized access to sensitive data, triggering mandatory breach reporting and significant fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vLLM to version 0.28.0 or later immediately. Disable or restrict access to model loading functions until patched. Review and audit all loaded models for suspicious files like processing_llava_onevision2.py.

Useful 0 Not Useful 0