vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to
    Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic
    processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the
    served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute
    arbitrary Python in the vLLM API process. (CVE-2026-114053)

ID	Name	Product	Family	Type	Severity
477954	Chainguard: vllm-omni-cuda-13.0: security update to 0.32.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
477954	Chainguard: vllm-omni-cuda-13.0: security update to 0.32.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
477606	SCA: security update for vllm (GHSA-h3rc-6mm3-gc2m)	Tenable Cloud Security	SCA Checks	Local	critical
477606	SCA: security update for vllm (GHSA-h3rc-6mm3-gc2m)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-114053

critical

Tenable Plugins

critical

critical

critical

critical