{"data":{"id":"ddfbc3e6-ecf1-4300-bf71-6e3a76904f55","title":"GHSA-3ww4-5jv9-j5gm: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors","summary":"GHSA-3ww4-5jv9-j5gm reports that vLLM's revision pinning does not consistently cover all artifacts loaded for a model. Deployments that set `--revision` or `--code-revision` can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights and config from an unpinned or default revision, so the pin does not describe the full artifact set served. The source states this is not a `trust_remote_code=False` bypass, unauthenticated RCE, or a demonstrated artifact compromise. The strongest example is Kimi-Audio, whose `whisper-large-v3` subfolder loads outside the configured revision.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-3ww4-5jv9-j5gm","publishedAt":"2026-06-10T17:11:38.000Z","cveId":"CVE-2026-47155","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["vllm@< 0.22.0 (fixed: 0.22.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["vLLM","Hugging Face","Kimi-Audio","Kimi-K2.5","Kimi-K2.5 image processor","BGE-M3","GGUF"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00249,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-3ww4-5jv9-j5gm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-10T17:11:38.000Z","fixReleasedAt":"2026-05-29T10:32:10.261Z","daysToFix":-12,"fixCheckedAt":"2026-10-29T21:34:46.325Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.22.0","matchedVersion":"0.22.0","fixReleasedAt":"2026-05-29T10:32:10.261Z","daysToFix":-12,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:34:46.178Z"}]}}