CVE-2026-22807High· 8.8▾ MidnightPoC availablevLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
1 GitHub repo
0.7% → 0.8%
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face auto_map dynamic modules during model resolution without gating on trust_remote_code, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
vllm >= 0.10.1, < 0.14.0Upgrade past the affected range:
vllm 0.14.0Affected packages:
vllm >= 0.10.1, < 0.14.0Patched in:
vllm 0.14.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-22778Critical· 9.8vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-24779High· 7.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-34753Medium· 5.4vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `
CVE-2026-54236Medium· 5.3vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
CVE-2026-73558Medium· 5.3vLLM is an inference and serving engine for large language models