FULL-ANALYSIS---CVE-2026-45829-ChromaDB-

CVE-2026-45829 - ChromaDB Pre-Auth RCE CVSS 10.0 ⚠️ WARNING This repository contains a FUNCTIONAL PoC for CVE-2026-45829. ONLY for authorized testing in controlled environments. Description Critical vulnerability in ChromaDB versions 1.0.0 to 1.5.8 that allows an unauthenticated attacker to execut...

llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

CVE-2026-58116 — LLaMA-Factory WebUI RCE via trustremotecode Proof of concept for CVE-2026-58116 CVSS 9.8 Critical: remote code execution in LLaMA-Factory = v0.9.5. The LLaMA-Factory WebUI hardcodes trustremotecode=True when loading a model src/llamafactory/webui/chatter.py:139 and...

CVE-2026-7669-PoC

CVE-2026-7669 SGLang silently overrides trustremotecode=False to True and re-invokes AutoTokenizer.frompretrained whenever transformers v5 returns a TokenizersBackend object. A model with a custom tokenizerclass and an automap pointing at tokenizer.py reaches arbitrary code execution inside the...

CVE-2026-22807_Range

🛡️ CVE-2026-22807 Simulation: AI Supply Chain RCE Target Range ⚠️ Disclaimer This project is intended solely for security research and educational purposes , aiming to demonstrate the supply chain attack principle Remote Code Execution during AI model loading. Do not use the generated malicious...

CVE-2026-5817-PoC

CVE-2026-5817: Docker Model Runner container-to-host RCE / Escape Any container on a Docker Desktop 4.40.0 to 4.67.x host can run code on the host with two HTTP requests. No socket mount, no --privileged, no caps. How Every container can reach Model Runner at model-runner.docker.internal with no...

vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

GHSA-H3RC-6MM3-GC2M vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary An untrusted multimodal request can set mmprocessorkwargs.coderevision. When vLLM serves a model whose Hugging Face processor uses dynamic automap code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.frompretrained and selects the Python revision...

EUVD-2026-107004

vLLM: Request-controlled mmprocessorkwargs.coderevision allows remote code execution...

GHSA-F623-HJM8-5WG5 Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h3rc-6mm3-gc2m. This link is maintained to preserve external references. Original Description vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers...

CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

CVE-2026-114053

The vLLM library versions 0.7.3 before 0.31.0 is vulnerable to Remote Code Execution (RCE) via the mm_processor_kwargs.code_revision parameter. The application forwards this user-supplied revision to Transformers AutoProcessor.from_pretrained . If trust_remote_code is enabled, an attacker who con...

CVE-2026-114053 vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

CVE-2026-114053 vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

CVE-2026-114053 vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

CVE-2026-90553

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

PYSEC-2026-3985

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

PYSEC-2026-3985

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

CVE-2026-90553

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader . The loader ignores the trust_remote_code parameter when loading remote processor classes, allowing an attacker to craft a malicious model with arbitrary code in processing_llava_onevision2....

Arbitrary Code Injection

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Arbitrary Code Injection in the LlavaOnevision2 loader due to improper handling of the trustremotecode parameter. An attacker can execute arbitrary...