CVE-2025-66448: vllm-project vllm Code Injection

Vulnerability summary

CVE-2025-66448 is a high (CVSS 8.8) Code Injection vulnerability in vllm-project vllm. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.6% of scored vulnerabilities.

Timeline

1. 01-12-2025
   PublishedVulnerability first disclosed.
2. 02-12-2025
   Last modifiedVulnerability information updated.

Description

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.