vLLM is an inference and serving engine for large language models. Versions starting at 0.10.1 and prior to 0.14.0 load Hugging Face auto_map dynamic modules during model resolution without gating on the trust_remote_code setting. This improper control of code generation (CWE-94) allows an attacker who can influence the model repository or path—either local or remote—to execute arbitrary Python code on the vLLM host during model startup. This code execution occurs before any request handling and does not require API access. The issue is resolved in vLLM version 0.14.0. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Red Hat has published multiple advisories referencing this CVE and provides updates for affected products.

An attacker able to control the model repository or path can achieve arbitrary code execution on the host running vLLM during model load, prior to any API request handling. This can lead to full compromise of the system, including confidentiality, integrity, and availability impacts. No privileges or API access are required for exploitation, only the ability to influence the model source location.

A fixed version of vLLM (0.14.0) is available that addresses this vulnerability by properly gating the loading of dynamic modules with the trust_remote_code setting. Users should upgrade to vLLM version 0.14.0 or later. Consult the Red Hat advisories for specific patched package versions and updates. No additional mitigations are indicated by the vendor advisory.