CVE-2025-66448
High · 7.1CVSS
7.1
EPSS
0.7%
Published
Dec 1, 2025
CISA due date
—
The record
vLLM vulnerable to remote code execution via transformers_utils/get_config
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | vllm | 0 | 0.11.1 |
Related vulnerabilities
- GHSA-8fr4-5q9j-m8gm vLLM vulnerable to remote code execution via transformers_utils/get_config Same vulnerability
- CVE-2026-22778 vLLM is an inference and serving engine for large language models (LLMs). Also affects vllm
- GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing Also affects vllm
- GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
- CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
- GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization Also affects vllm
- CVE-2026-22807 vLLM affected by RCE via auto_map dynamic module loading during model initialization Also affects vllm
- GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous… Also affects vllm