EUVD-2026-107004

vLLM: Request-controlled mmprocessorkwargs.coderevision allows remote code execution...

Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references. Original Description vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers...

PT-2026-120179

Name of the Vulnerable Software and Affected Versions vLLM versions 0.7.3 through 0.30.x Description When trust remote code is enabled, the software forwards the request-supplied mm processor kwargs.code revision to the Transformers AutoProcessor.from pretrained function. This allows clients to...

vLLM code injection vulnerability

Versions vLLM 0.7.3 through 0.31.0 contain a code injection vulnerability. This vulnerability arises when the mmprocessorkwargs.coderevision parameter provided by the request is passed to Transformers AutoProcessor.frompretrained. When trustremotecode is enabled, it allows clients to specify whic...