Adithyan-Ak

🚨High - vLLM RCE via AutoProcessor code revision Injection (CVE-2026-114053) vLLM forwards client-supplied mm processor kwargs.code revision into Transformers AutoProcessor.from pretrained when trust remote code is enabled, letting attackers pick a malicious model revision whose dynamic processor code is imported. If the attacker controls a revision in the served model repo, a multimodal request to the unauthenticated /tokenize endpoint yields arbitrary Python code execution in the API process. 👉Affected: vllm >= 0.7.3, < 0.31.0 | Upgrade to 0.31.0

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.30.0 **Description** A partial denial of service issue exists in the OpenAI-compatible chat endpoint. A remote caller can provide large values for the `fps` and `max frames` variables within the `media io kwargs` field while selecting the GLMGA video backend. This allows the system to construct and deduplicate an excessively large pre-decode frame-index list in the shared media-loading executor, even if the provided video is very small. Consequently, a compact request can consume disproportionate CPU time and memory, delaying other unrelated media requests. This occurs because there is no strict upper bound on sampling work before the index list is constructed. **Recommendations** Update to version 0.30.0. As a temporary workaround, remove or filter request-level `video backend`, `fps`, and `max frames` options at the gateway. Restrict untrusted callers from selecting the GLMGA backend. Apply authentication, rate limiting, request concurrency limits, and process memory isolation.