CVE-2026-22807: vLLM affected by RCE via auto_map dynamic module loading during model initialization
Vulnerability summary
CVE-2026-22807 is a critical (CVSS 9.8) Code Injection vulnerability in vllm-project vllm. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 21-01-2026PublishedVulnerability first disclosed.
- 21-07-2026Last modifiedVulnerability information updated.
Description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.82%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.83% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- py3.10-vllm-cuda-12.4< 0.14.0-r0
- py3.12-vllm-cuda-12.4< 0.14.0-r0
- tritonserver-backend-vllm-cuda-12.9< 25.9.0_git20251112-r7 | < 25.9.0_git20251112-r6 | < 25.9.0_git20260318-r0
- tritonserver-backend-vllm-cuda-13.0< 25.11-r2
PyPI1 product
- vllm≥ 0.10.1, < 0.14.0
Vllm1 product
- vllm≥ 0.10.1, < 0.14.0
Vllm-project1 product
- vllm≥ 0.10.1, < 0.14.0
4 vendors · 7 products
References
23 links- github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmrX Refsource CONFIRMWEBAdvisoryPatchVendor Advisory
- github.com/vllm-project/vllm/commit/78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5X Refsource MISCWEBFIXPatch
Show all 23 references
- github.com/vllm-project/vllmPACKAGE