Vulnerability · Published Dec 1, 2025 · Assigned by GitHub_M
CVE-2025-66448vLLM vulnerable to remote code execution via transformers_utils/get_config
High 7.1
In plain English
A high-severity code injection in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | vllm | 0.11.1 | GHSA-8fr4-5q9j-m8gm |
| PyPI | vllm | 0.11.1 | PYSEC-2026-2015 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vllm-project | vllm | < 0.11.1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/vllm-project/vllm/security/advisories/GHSA-8fr4-5q9j-m8gm x_refsource_CONFIRM
- https://github.com/vllm-project/vllm/pull/28126 x_refsource_MISC
- https://github.com/vllm-project/vllm/commit/ffb08379d8870a1a81ba82b72797f196838d0c86 x_refsource_MISC