HighVulnerabilityLLM-specific
CVE-2026-22807: vLLM arbitrary code execution through Hugging Face auto_map model loading
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-22807
- Published
- Record updated
- Affected
- vllm >= 0.10.1, < 0.14.0
- Fixed in
- 0.14.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.8%
Summary
vLLM versions from 0.10.1 up to but not including 0.14.0 load Hugging Face `auto_map` dynamic modules during model resolution without checking `trust_remote_code`. An attacker who can influence the model repo or path, whether a local directory or a remote Hugging Face repo, can run arbitrary Python code on the vLLM host at server startup, before any request handling and without API access.
Mitigation
Fixed in 0.14.0.
Topics
Related items
- InfoStepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines Similar attack · StepSecurity Blog
- LowCVE-2026-107288: Pydantic AI web fetch bypasses blocked_domains via hostname variantsSimilar attack · NVD/CVE Database
- LowOAuth grants pile up faster than you can review them. Here's how to keep up.Similar attack · BleepingComputer
- MediumTop MCP security resources — October 2026Similar attack · Adversa AI Blog
- MediumTensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackSimilar attack · Socket Blog