GHSA-8jr5-v98p-w75m: vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

Summary

GHSA-8jr5-v98p-w75m affects vLLM's image input handling in vllm/multimodal/image.py. The code never calls ImageOps.exif_transpose, so EXIF orientation is not normalized, and PNGs carrying tRNS transparency in P, L or RGB modes take the image.convert("RGB") path without being flattened against a background, so transparent or overlay content can become visible and change the pixels the model receives. Pillow also loads only the first frame of APNG and GIF files.

Mitigation

A fix for this vulnerability was merged here: https://github.com/vllm-project/vllm/pull/44974

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• vllmPyPILLM dependency since 2023-08-25 · 15 tracked dependents

Topics

• Inference infrastructure

Related items

• InfoAnchored Rank-Adversarial Fine-Tuning Pretrained Visual Place Recognition ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoSay the Same, Act Differently: Diagnosing and Steering Text-Action Divergence in Reasoning VLAsSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoDetect, Repair and Audit: A Hierarchical Multi-Agent Defense Against Adversarial Attacks in Energy ForecastingSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSANAI: Secure ECC Distributed Keyed Parity Embedded in Weights for Protecting Neural Networks against Bit-Flip AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoTowards Fine-grained and Robust Detection of Human-AI Co-authorshipSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)