Threats tagged 'ghsa-h3rc-6mm3-gc2m'

vLLM versions from 0.7.3 up to but not including 0.31.0 have a vulnerability where an attacker can control the mm_processor_kwargs.code_revision parameter in multimodal requests. When the operator enables trust_remote_code and serves a model whose Hugging Face processor uses dynamic auto_map code, this allows the attacker to execute arbitrary Python code by importing a malicious processor module revision. The vulnerability is exploitable via unauthenticated /tokenize endpoints unless protected externally. A fix is available in vLLM version 0.31.0.