CVE-2026-73560

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0

Description The MiMoV2OmniMultiModalProcessor in vllm/transformers utils/processors/mimo v2 omni.py improperly handles image and audio strings. By passing attacker-controlled strings through fetch image, requests.get, and Image.open instead of using the MediaConnector, the system bypasses allowed media domains and allowed local media path protections. This allows for server-side requests and the reading of arbitrary files accessible to the vLLM process.

Recommendations Update to version 0.26.0.