Vulnerabilities

vLLM before 0.28.0 is vulnerable to remote code execution through its LlavaOnevision2 processor loader, which loads remote processor classes without honoring the trust_remote_code parameter. An attacker can publish or substitute a crafted model containing arbitrary code in processing_llava_onevision2.py; when a victim's vLLM instance loads that model, the code executes with the privileges of the vLLM process even if trust_remote_code is explicitly set to False. A successful attacker gains code execution in the inference server, which typically holds model weights and often has access to GPUs, internal APIs, and other cluster resources. Any deployment running an affected vLLM version that loads LlavaOnevision2-family models, particularly models pulled from public model hubs or shared registries, is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known; the CVSS vector (AV:L/UI:P) reflects that exploitation requires an operator or pipeline to load the attacker-controlled model.

Do: Upgrade to vLLM 0.28.0 or later. Until then, do not load LlavaOnevision2-family models from untrusted or unverified sources on affected versions, since setting trust_remote_code=False does not prevent exploitation. Audit which model repositories and revisions your inference pipelines pull, pin to trusted model hashes, and restrict network egress from vLLM servers to limit the impact of any code execution.

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks structural issues such as lookarounds and backreferences but performs no complexity analysis, so a pattern with nested quantifiers passes all checks and causes exponential state-space expansion, allowing a single request containing an adversarial regex to hang an inference worker indefinitely and deny service. This issue is fixed in version 0.24.0.

vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose prior fix only disabled the feature by default rather than addressing the root cause.