Log in Start free

Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M

CVE-2026-22807vLLM affected by RCE via auto_map dynamic module loading during model initialization

High 8.8

In plain English

A high-severity code injection in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 37.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIvllm0.14.0GHSA-2pc9-4j83-qjmr
PyPIvllm0.14.0PYSEC-2026-2010

Affected products (as reported)

VendorProductVersions
vllm-project vllm >= 0.10.1, < 0.14.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References