Remote Code Execution Vulnerability in vllm Package via torch.load
Summary
CVE-2025-24357: vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator. Affects vllm versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vllm package is designed for efficient model execution and management, particularly in the context of machine learning. It facilitates the loading and handling of model checkpoints, often sourced from Hugging Face repositories. However, the package has a critical vulnerability that arises from its use of the torch.load function, which can lead to severe security risks if malicious model weights are loaded.
Vulnerability Detail
The vulnerability originates from the implementation of the hf_model_weights_iterator function in the vllm/model_executor/weight_utils.py file. This function uses torch.load to load model checkpoints, with the weights_only parameter set to False by default. According to PyTorch documentation, using torch.load on untrusted data can execute arbitrary code during the unpickling process, leading to potential remote code execution (RCE) on the victim's machine. This issue is particularly concerning for users who fetch pretrained models from remote repositories, as it could allow attackers to execute arbitrary commands on the victim's system.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0
This is the first release that contains the fix.
pip install --upgrade "vllm==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading model weights from untrusted sources or switch to using models in the safetensors format, which is not vulnerable to this issue.
Conclusion
The vllm package has a critical vulnerability that can lead to remote code execution through the insecure loading of model weights. Users are strongly advised to update to version 0.7.0 or later to mitigate this risk. Additionally, utilizing the Vulert platform can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vllm →
FAQ
The vulnerability allows for remote code execution through the insecure loading of model weights using torch.load, which can execute arbitrary code if malicious data is provided.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
If an immediate update is not possible, avoid loading model weights from untrusted sources and consider using the safetensors format for model weights.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can find more information about the vllm package and its functionalities on its official repository or documentation page.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
