{"id":"CVE-2025-66448","published":"2025-12-01T22:45:42Z","modified":"2025-12-02T14:14:58Z","title":"vLLM vulnerable to remote code execution via transformers_utils/get_config","vendor":"vllm-project","product":"vllm","tier":"tail","description":{"text":"vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0066,"percentile":0.51432,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-8fr4-5q9j-m8gm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vllm-project/vllm/pull/28126","tags":["x_refsource_MISC"]},{"url":"https://github.com/vllm-project/vllm/commit/ffb08379d8870a1a81ba82b72797f196838d0c86","tags":["x_refsource_MISC"]}],"priority":{"score":15.3,"factors":[{"name":"EPSS percentile","points":10.29},{"name":"CVSS severity","points":4.97}]},"vendorSlug":"vllm-project","affectedVersions":[{"vendor":"vllm-project","product":"vllm","versions":["< 0.11.1"]}],"affected":[{"ecosystem":"PyPI","package":"vllm","vulnerableRanges":["<0.11.1"],"patched":["0.11.1"],"from":["GHSA-8fr4-5q9j-m8gm","PYSEC-2026-2015"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-200115","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vllm-project-vllm-cve-2025-66448","children":[{"from":"CVE-2025-66448","to":"CVE-2026-4944","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files.","from":"CVE.org","in":"CVE-2026-4944"}]}]}}