CVE-2026-114053: Improper Control of Generation of Code ('Code Injection') in vllm-project vllm

The vulnerability in vLLM (versions >=0.7.3 <0.31.0) arises from improper control over the generation of code. Specifically, the mm_processor_kwargs.code_revision parameter supplied by clients is forwarded to Transformers AutoProcessor.from_pretrained, enabling selection of the model's dynamic processor code revision. When trust_remote_code is enabled, an attacker who controls a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint, resulting in arbitrary Python code execution within the vLLM API process.

Successful exploitation allows an unauthenticated attacker to execute arbitrary Python code on the vLLM API process, leading to full compromise of the affected system. The vulnerability has a CVSS 4.0 score of 9.2 (critical), indicating high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable trust_remote_code or restrict access to the /tokenize endpoint to trusted users only. Avoid exposing the vLLM API to untrusted networks or users.