vLLM 0.8.3 < 0.14.1 Information Disclosure (GHSA-4r2x-xpjr-7cvv)

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#

include('compat.inc');

if (description)
{
  script_id(363842);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2026-22778");

  script_name(english:"vLLM 0.8.3 < 0.14.1 Information Disclosure (GHSA-4r2x-xpjr-7cvv)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a Python package installed that is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the vLLM Python package installed on the remote host is 0.8.3 prior to 0.14.1. It is, therefore,
affected by an information disclosure vulnerability. When an invalid image is sent to the vLLM multimodal endpoint,
PIL throws an error that vLLM returns to the client, leaking a heap address and largely defeating ASLR. This can be
chained with a heap overflow in the JPEG2000 decoder used by OpenCV/FFmpeg to achieve remote code execution, but
only against deployments serving a video model.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-4r2x-xpjr-7cvv");
  script_set_attribute(attribute:"see_also", value:"https://github.com/vllm-project/vllm/releases/tag/v0.14.1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to vLLM version 0.14.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22778");
  script_cwe_id(209, 532);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vllm:vllm");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'vllm';
var cpe = 'cpe:/a:vllm:vllm';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'min_version' : '0.8.3', 'fixed_version' : '0.14.1' }
];

# Exploitability requires a video-model deployment; Nessus cannot confirm this.
vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_HOLE, require_paranoia:TRUE);