CVE-2026-22807
High · 8.8vLLM affected by RCE via auto_map dynamic module loading during model initialization
CVSS
8.8
EPSS
0.8%
Published
Jan 21, 2026
CISA due date
—
The record
vLLM loads Hugging Face `auto_map` dynamic modules during model resolution **without gating on `trust_remote_code`**, allowing attacker-controlled Python code in a model repo/path to execute at server startup. ---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | vllm | 0.10.1 | 0.14.0 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0 | 0.14.0-r0 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0 | 0.14.0-r0 |
| pypi | vllm | 0.10.1 | No fix |
Related vulnerabilities
- GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization Same vulnerability
- CVE-2026-22778 vLLM is an inference and serving engine for large language models (LLMs). Also affects vllm
- GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing Also affects vllm
- GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
- CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
- GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous… Also affects vllm
- CVE-2026-22773 vLLM is an inference and serving engine for large language models (LLMs). Also affects vllm
- GHSA-mcmc-2m55-j8jj vLLM introduced enhanced protection for CVE-2025-62164 Also affects vllm