CVE-2026-22807 vLLM affected by RCE via auto_map dynamic module loading during model initialization
Attackers can execute arbitrary code on vLLM hosts by supplying malicious model repositories, bypassing trust_remote_code checks during initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-22807?
CVE-2026-22807 is a high-severity code injection vulnerability in Vllm Vllm, published on 21 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
Weakness: CWE-94
Which versions are affected by CVE-2026-22807?
3 open source packages ship an affected version, including vllm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vllm PyPI | From 0.10.1 | 0.14.0 |
vllm PyPI | From 0.10.1 | 0.14.0 |
vllm PyPI | From 0.10.1 | 0.14.0 |
Products include Vllm Vllm.
How do I fix CVE-2026-22807?
Upgrade vllm to 0.14.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-22807 being exploited?
There is no known exploitation of CVE-2026-22807 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Vllm Vllm
- CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration
- CVE-2026-22778 vLLM leaks a heap address when PIL throws an error
- CVE-2025-47277 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
- CVE-2024-11041 Remote Code Execution in vllm-project/vllm
- CVE-2026-48746 vLLM: OpenAI auth bypass
Sources
Also known as GHSA-2pc9-4j83-qjmr, PYSEC-2026-2010.