8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22807

CVE-2026-22807: vLLM affected by RCE via auto_map dynamic module loading during model initialization

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face auto_map dynamic modules during model resolution without gating on trust_remote_code, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22807

CVE-2026-22807:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	>= 0.10.1, < 0.14.0	0.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the model loading process of vLLM, where it handles auto_map entries from a model's configuration. The root cause is the failure to check the trust_remote_code flag before loading and executing Python code from a model's repository.

The analysis of the patch 78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5 reveals two key functions involved:

_try_resolve_transformers in vllm/model_executor/models/registry.py: This function is responsible for resolving model classes. The patch adds the trust_remote_code parameter to its calls to try_get_class_from_dynamic_module. Before this change, it would trigger the dynamic module loading without any security check, making it a key part of the vulnerability chain.
try_get_class_from_dynamic_module in vllm/transformers_utils/dynamic_module.py: This function directly handles the loading of the dynamic module. The patch modifies this function to accept a trust_remote_code parameter and explicitly check it using resolve_trust_remote_code before proceeding. The vulnerable version of this function lacked this check, leading directly to remote code execution if a model's auto_map pointed to malicious code.

An attacker can exploit this by crafting a Hugging Face model repository with a malicious Python file and an auto_map entry in the config.json that points to it. When a vLLM server attempts to load this model, the vulnerable functions execute the malicious code, resulting in remote code execution on the server.

Vulnerable functions

_try_resolve_transformers

vllm/model_executor/models/registry.py

This function resolves model classes from Hugging Face `auto_map` entries. In vulnerable versions, it called `try_get_class_from_dynamic_module` without passing the `trust_remote_code` setting, leading to the unconditional execution of remote code from the model's repository.

try_get_class_from_dynamic_module

vllm/transformers_utils/dynamic_module.py

This function is a wrapper around `transformers.dynamic_module_utils.get_class_from_dynamic_module`. In vulnerable versions, it did not check the `trust_remote_code` flag before calling the transformers function, which executes code from the remote module upon loading. This allows an attacker to run arbitrary code by providing a malicious model.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.