80 matches found
MAL-2026-991 Malicious code in vl-ui-breadcrumb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c270ce4308a58eda8d509b95c7598472480a53a99953d598e400e85440f563 The package vl-ui-breadcrumb was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in vl-ui-breadcrumb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c270ce4308a58eda8d509b95c7598472480a53a99953d598e400e85440f563 The package vl-ui-breadcrumb was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-990 Malicious code in vl-ui-body (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd90d73547d2e88c7a229ca9924f96c2d5e43bc5b1a8cb6b8a182d322d783510 The package vl-ui-body was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in vl-ui-checkbox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b636f4789648035c4ee34537313e51b2e4ba39f2f4ea19b6d8744f61a12bce3 The package vl-ui-checkbox was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-993 Malicious code in vl-ui-checkbox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b636f4789648035c4ee34537313e51b2e4ba39f2f4ea19b6d8744f61a12bce3 The package vl-ui-checkbox was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-987 Malicious code in vl-ui-accessibility (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7e52c3145cd55d304bb64380b4ac900f8fcda605ef0d88ad4b445709c1fa6f The package vl-ui-accessibility was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in vl-ui-accessibility (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7e52c3145cd55d304bb64380b4ac900f8fcda605ef0d88ad4b445709c1fa6f The package vl-ui-accessibility was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-989 Malicious code in vl-ui-alert (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b178c0c090ebb69682438481586f4d0c78dbcd8938f14ce595469fe3796916 The package vl-ui-alert was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in vl-ui-alert (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b178c0c090ebb69682438481586f4d0c78dbcd8938f14ce595469fe3796916 The package vl-ui-alert was found to contain malicious code. Source: ossf-package-analysis...
vLLM vulnerable to remote code execution via transformers_utils/get_config
Summary vllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with getclassfromdynamicmodule... and immediately instantiates the returned class. This...
GHSA-8FR4-5Q9J-M8GM vLLM vulnerable to remote code execution via transformers_utils/get_config
Summary vllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with getclassfromdynamicmodule... and immediately instantiates the returned class. This...
CVE-2025-66448
vLLM is an inference and serving engine for large language models LLMs. Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with...
Arbitrary Code Injection
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Arbitrary Code Injection via the config class named NemotronNanoVLConfig. An attacker can execute arbitrary code on the host system by publishing a...
CVE-2025-66448
vLLM (prior to 0.11.1) contains a remote code execution vulnerability in Nemotron_Nano_VL_Config where, during model loading, an auto_map entry can cause get_class_from_dynamic_module to fetch and execute code from a remote repository, bypassing trust_remote_code checks. This can enable an attack...
PT-2025-48580
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.11.1 Description vLLM is an inference and serving engine for large language models LLMs. A critical issue exists in the Nemotron Nano VL Config class where remote code execution can occur. When vLLM loads a model...
Malicious code in @zalastax/nolb-_vl (npm)
The package @zalastax/nolb-vl was found to contain malicious code...
MAL-2025-43095 Malicious code in @zalastax/nolb-_vl (npm)
The package @zalastax/nolb-vl was found to contain malicious code...
MAL-2025-38528 Malicious code in vl-ui-template (npm)
The package vl-ui-template was found to contain malicious code...