CVE-2025-66448 vLLM vulnerable to remote code execution via transformers_utils/get_config
Attackers can achieve remote code execution by publishing malicious model configs that bypass trust_remote_code settings in vLLM.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66448?
CVE-2025-66448 is a high-severity code injection vulnerability in Vllm Vllm, published on 1 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.
Weakness: CWE-94
Which versions are affected by CVE-2025-66448?
3 open source packages ship an affected version, including vllm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vllm PyPI | All versions | 0.11.1 |
vllm PyPI | All versions | 0.11.1 |
vllm PyPI | All versions | 0.11.1 |
Products include Vllm Vllm.
How do I fix CVE-2025-66448?
Upgrade vllm to 0.11.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-66448 being exploited?
There is no known exploitation of CVE-2025-66448 in the wild and no public exploit code.
Other vulnerabilities in Vllm Vllm
- CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration
- CVE-2026-22778 vLLM leaks a heap address when PIL throws an error
- CVE-2025-47277 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
- CVE-2024-11041 Remote Code Execution in vllm-project/vllm
- CVE-2026-48746 vLLM: OpenAI auth bypass
Sources
Also known as GHSA-8fr4-5q9j-m8gm, PYSEC-2026-2015.