CVE-2026-114053

Name of the Vulnerable Software and Affected Versions vLLM versions 0.7.3 through 0.30.x

Description When trust remote code is enabled, the software forwards the request-supplied mm processor kwargs.code revision to the Transformers AutoProcessor.from pretrained function. This allows clients to select which revision of a model's dynamic processor code is imported. An attacker who controls a revision in the served model repository can send a multimodal request to the unauthenticated '/tokenize' endpoint to execute arbitrary Python code within the vLLM API process.

Recommendations Upgrade to version 0.31.0.