CVE-2026-100653: Use of Less Trusted Source in vllm-project vllm
vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.
AI Analysis
Technical Summary
In vLLM versions from 0.22.1 up to but not including 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads related to the FunAudioChat and Tarsier2 architectures. Specifically, the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast in funaudiochat.py and the Qwen2VLConfig.from_pretrained call in qwen2_vl.py do not respect the pinned revision. Consequently, these components load from the repository's default revision, allowing changes in the upstream default branch to affect audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration despite the operator's pinned deployment. This is a supply-chain integrity and reproducibility failure residual to a prior fix (GHSA-3ww4-5jv9-j5gm / CVE-2026-47155). The vulnerability does not enable remote code execution or bypass trust_remote_code=False. The issue is resolved in vLLM 0.28.0.
Potential Impact
Deployments pinned to a specific model revision may inadvertently load processor, tokenizer, or configuration artifacts from the repository's default branch instead of the pinned revision. This undermines supply-chain integrity and reproducibility, potentially causing unexpected changes in audio preprocessing and model behavior without operator changes. There is no direct remote code execution or privilege escalation impact.
Mitigation Recommendations
Upgrade to vLLM version 0.28.0 or later, where this issue is fixed. No other mitigation is required as the vulnerability is resolved in this official fix.
CVE-2026-100653: Use of Less Trusted Source in vllm-project vllm
Description
vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.
CVSS v4.0
Score 8.3high
Affected software
vllm-project
vllm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In vLLM versions from 0.22.1 up to but not including 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads related to the FunAudioChat and Tarsier2 architectures. Specifically, the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast in funaudiochat.py and the Qwen2VLConfig.from_pretrained call in qwen2_vl.py do not respect the pinned revision. Consequently, these components load from the repository's default revision, allowing changes in the upstream default branch to affect audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration despite the operator's pinned deployment. This is a supply-chain integrity and reproducibility failure residual to a prior fix (GHSA-3ww4-5jv9-j5gm / CVE-2026-47155). The vulnerability does not enable remote code execution or bypass trust_remote_code=False. The issue is resolved in vLLM 0.28.0.
Potential Impact
Deployments pinned to a specific model revision may inadvertently load processor, tokenizer, or configuration artifacts from the repository's default branch instead of the pinned revision. This undermines supply-chain integrity and reproducibility, potentially causing unexpected changes in audio preprocessing and model behavior without operator changes. There is no direct remote code execution or privilege escalation impact.
Mitigation Recommendations
Upgrade to vLLM version 0.28.0 or later, where this issue is fixed. No other mitigation is required as the vulnerability is resolved in this official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:33:07.899Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9a9f7a7c5410652fd3c
Added to database: 09/26/2026, 13:33:29 UTC
Last enriched: 09/26/2026, 14:02:47 UTC
Last updated: 09/27/2026, 03:03:42 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.