CVE-2026-114053: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
An untrusted multimodal request can set mm_processor_kwargs.code_revision. When vLLM serves a model whose Hugging Face processor uses dynamic auto_map code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.from_pretrained and selects the Python revision imported by Transformers.
This lets a client replace the operator-reviewed processor module with code from another revision of the same model repository. The operator-selected model/data revision remains pinned; only the executed processor code changes.
Importing a Python module is arbitrary code execution in the vLLM API/renderer process. The PoC below demonstrates this with an import-time filesystem write. It is fully offline and does not require a GPU, model weights, or changes to a real Hub repository.
References
- github.com/advisories/GHSA-h3rc-6mm3-gc2m
- github.com/vllm-project/vllm/commit/31f2e70cd3e403aaa471fb7fe3d33a7207aaf3cc
- github.com/vllm-project/vllm/pull/58830
- github.com/vllm-project/vllm/releases/tag/v0.31.0
- github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-6mm3-gc2m
- nvd.nist.gov/vuln/detail/CVE-2026-114053
- nvd.nist.gov/vuln/detail/cve-2026-114053
- www.vulncheck.com/advisories/vllm-0.7.3-before-0.31.0-rce-via-mm-processor-kwargs-code-revision
Code Behaviors & Features
Detect and mitigate CVE-2026-114053 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →