{"data":{"id":"e1fd34b5-73a5-40b6-a1fe-74a6c9a504eb","title":"GHSA-q8gq-377p-jq3r: vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution","summary":"An assert-based security check in vLLM's activation function loading, at vllm/model_executor/layers/pooler/activations.py:48, restricts which functions can be loaded from a HuggingFace model's config.json. When vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1), Python strips the assert, so an attacker-published malicious model can pass an arbitrary function_name to resolve_obj_by_qualname() and execute code during model initialization. The attack requires the victim to load the malicious model and the model to use a cross-encoder architecture.","solution":"Suggested fix: replace the assert with an explicit conditional raise: if not function_name.startswith(\"torch.nn.modules.\"): raise ValueError(\"Loading of activation functions is restricted to torch.nn.modules for security reasons\"). The source text ends mid-sentence at \"A fix for this\", so no released fixed version is stated.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q8gq-377p-jq3r","publishedAt":"2026-06-16T17:34:49.000Z","cveId":"CVE-2026-41523","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["supply_chain","other"],"issueType":"vulnerability","affectedPackages":["vllm@< 0.22.0 (fixed: 0.22.0)"],"affectedPackageNames":["vllm"],"affectedPackageRefs":["pypi:vllm"],"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["vLLM","HuggingFace"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00913,"epssCheckedAt":"2026-11-04T18:09:14.312Z","kevDateAdded":null,"advisoryAliases":["GHSA-q8gq-377p-jq3r"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-16T17:34:49.000Z","fixReleasedAt":"2026-05-29T10:32:10.261Z","daysToFix":-18,"fixCheckedAt":"2026-10-29T21:34:35.502Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"vllm","fixedVersion":"0.22.0","matchedVersion":"0.22.0","fixReleasedAt":"2026-05-29T10:32:10.261Z","daysToFix":-18,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:34:35.355Z"}]}}