SOURCE-LINKED INTELLIGENCE
GHSA-hjq4-87xh-g4fv: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
### Impacted Environments This issue ONLY impacts environments using the `PyNcclPipe` KV cache transfer integration with the V0 engine. No other configurations are affected. ### Summary vLLM supports the use of the `PyNcclPipe` class to establish a peer-to-peer communication domain for data transmission between distributed nodes. The GPU-side KV-Cache transmission is implemented through the `PyNcclCommunicator` class, while CPU-side control message passing is handled via the `send_obj` and `recv_obj` methods on the CPU side. A remote code execution vulnerability exists in the `PyNcclPipe` ser
Read original source ↗ Open in workspace
- recordType
- vulnerability
- status
- active
- evidenceStatus
- reported
- region
- Global
Evidence & attribution
- OSV AI package advisories · 2025-05-20T18:04:30.000Z
- OSV AI package advisories · 2026-06-29T11:50:35.995Z
First collected: 2026-09-20T22:31:48.298Z. This is not the publication date.