vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and
    prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution
    without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to
    execute at server startup. An attacker who can influence the model repo/path (local directory or remote
    Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens
    before any request handling and does not require API access. Version 0.14.0 fixes the issue.
    (CVE-2026-22807)

ID	Name	Product	Family	Type	Severity
436871	SCA: security update for vllm (GHSA-2pc9-4j83-qjmr)	Tenable Cloud Security	SCA Checks	Local	critical
436871	SCA: security update for vllm (GHSA-2pc9-4j83-qjmr)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-22807

critical

Tenable Plugins

critical

critical