CVE-2025-66448: vLLM remote code execution through Nemotron_Nano_VL_Config auto_map entry

Summary

vLLM versions prior to 0.11.1 contain a critical remote code execution flaw in the Nemotron_Nano_VL_Config config class. When a model config includes an auto_map entry, the class calls get_class_from_dynamic_module(...) and instantiates the returned class, which fetches and runs Python from the referenced remote repository, even when trust_remote_code=False is set in vllm.transformers_utils.config.get_config. An attacker can publish a benign-looking frontend repo whose config.json points to a malicious backend repo, so loading the frontend silently executes the backend's code on the victim host.

Mitigation

Fixed in 0.11.1.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents

Topics

• Inference infrastructure

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database
• HighCVE-2026-118623: MLflow PickleEvaluationArtifact remote code execution via untrusted pickleSimilar attack · NVD/CVE Database
• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database