In vLLM versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads related to FunAudioChat and Tarsier2 architectures. Specifically, the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in funaudiochat.py and the Qwen2VLConfig.from_pretrained call in qwen2_vl.py do not respect the pinned revision. Consequently, even when deployments are pinned to a reviewed revision, these artifacts are resolved from the repository's default revision, allowing upstream changes to affect audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without changes to the operator's pin. This represents a supply-chain integrity and reproducibility failure but does not enable remote code execution or bypass trust_remote_code=False. The vulnerability is fixed in vLLM version 0.28.0.

The vulnerability causes a supply-chain integrity and reproducibility failure where pinned deployments may load behavior-affecting artifacts from an unintended revision, potentially altering processing and configuration without operator consent. There is no remote code execution or trust_remote_code bypass. This could lead to unexpected behavior in audio preprocessing and tokenizer functions in affected architectures.

Upgrade to vLLM version 0.28.0 or later, where this issue is fixed. No other mitigation is indicated. Since the fix is available, operators should apply the official update to ensure that model revision pins are correctly propagated.