CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

EUVD-2026-107004

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

PT-2026-120179

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm processor kwargs.code revision to Transformers AutoProcessor.from pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust remote code is enabled. An attacker controlling a revision ...