CVE-2026-47155

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.22.0

Description vLLM is an inference and serving engine for large language models. The software contains a supply-chain integrity issue where revision pinning controls are not consistently applied to all artifacts loaded for a model. When a deployment uses --revision or --code-revision, vLLM may still load certain components from an unpinned or default revision. These components include dynamic code, GGUF files, image processors, retrieval side weights, or weights and configurations from same-repository subfolders.

Technical details indicate that the issue stems from the improper propagation of explicit artifact pins across various loader paths. For example, the try resolve transformers() function omits code revision for external auto map dynamic module imports, and the hf hub download() function is called without a revision argument for direct-file GGUF forms. Additionally, specific model implementations like Kimi-Audio and BGE-M3 declare secondary weights or configurations with revision=None, causing them to resolve outside the audited revision.

Recommendations Update vLLM to version 0.22.0.