CVE-2026-22807: vLLM Arbitrary Code Execution via Unchecked Dynamic Module Loading
Summary
CVE-2026-22807: vLLM affected by RCE via auto_map dynamic module loading during model initialization. Affects vllm versions >= 0.10.1, < 0.14.0. Fixed in 0.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient model serving and inference, particularly with Hugging Face models. It facilitates the deployment of machine learning models, allowing users to load and execute models seamlessly. However, vLLM has a critical vulnerability that arises from its handling of dynamic module loading during model initialization, which can lead to severe security risks.
Vulnerability Detail
The vulnerability in vLLM stems from its practice of loading dynamic modules from the Hugging Face auto_map during model resolution without verifying the trust_remote_code setting. This oversight allows an attacker to embed malicious Python code in a model repository, which can be executed on the vLLM host during model loading. The execution occurs before any request handling, meaning that an attacker can achieve arbitrary code execution without needing API access. This vulnerability affects all versions of vLLM where the try_get_class_from_dynamic_module function is called without appropriate checks, making it a critical security concern.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading models from untrusted sources or ensure that the trust_remote_code setting is explicitly set to false. However, this does not fully mitigate the risk and should not be considered a long-term solution.
Conclusion
The vLLM package has a significant vulnerability that allows for arbitrary code execution due to improper handling of dynamic module loading. Users are strongly advised to update to version 0.14.0 or later to mitigate this risk. For those unable to update immediately, implementing temporary workarounds is crucial to protect against potential exploitation.
See every vulnerability recorded for vllm →
FAQ
CVE-2026-22807 is a vulnerability in the vLLM package that allows for arbitrary code execution due to unchecked dynamic module loading during model initialization.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update to the patched version, ensure that you do not load models from untrusted sources and set the trust_remote_code to false as a temporary measure.
The vulnerability was reported by bugbunny.ai, highlighting the security risks associated with the vLLM package.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
