SOURCE-LINKED INTELLIGENCE

GHSA-8fr4-5q9j-m8gm: vLLM vulnerable to remote code execution via transformers_utils/get_config

OSV AI package advisories · observation · Dec 2, 2025 · UTC

### Summary `vllm` has a critical remote code execution vector in a config class named `Nemotron_Nano_VL_Config`. When `vllm` loads a model config that contains an `auto_map` entry, the config class resolves that mapping with `get_class_from_dynamic_module(...)` and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the `auto_map` string. Crucially, this happens even when the caller explicitly sets `trust_remote_code=False` in `vllm.transformers_utils.config.get_config`. In practice, an attacker can publish a benign-looking fr

Read original source ↗ Open in workspace

recordType

vulnerability

status

active

evidenceStatus

reported

region

Global