A multimodal model service may decide that a client requested an image while delegating actual decoding to a library that detects formats from the bytes. When EPS reaches a locally installed PostScript interpreter, a nominally image-only input becomes an interpreter input. The exploit thus depends on two distinct validation gaps. An advisory traces image…
Inspect the ClaimsCase · DiggingBeagle record
vLLM image format autodetection could reach an installed vulnerable Ghostscript
The vLLM project discloses a format-confusion path where an EPS image presented as PNG reaches an installed Ghostscript interpreter. Demonstrated command execution depended on a separately vulnerable Ghostscript version.
Scope
The project traces the media loader and demonstrates a marker under specific dependency versions. A universal live Internet-to-shell result in all model deployments is not established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-38 cites SRC-2026-CP21-VLLM-GHOSTSCRIPT-EPS at GHSA-h3rc-j82p-2c3h, Proof of Concept and Environment, loader-level execution versus HTTP. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting research_demonstration; exploit status demonstrated; remediation status patch_available. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-38 · vLLM advisory: EPS disguised as PNG reaches Ghostscript via Pillow
At a glance
This is a chained-media-dependency boundary, not evidence of a flaw in the model weights.
Read the implicationsThe project traces the media loader and demonstrates a marker under specific dependency versions. A universal live Internet-to-shell result in all model deployments is not established.
Limits and uncertaintyFull account
A multimodal model service may decide that a client requested an image while delegating actual decoding to a library that detects formats from the bytes. When EPS reaches a locally installed PostScript interpreter, a nominally image-only input becomes an interpreter input. The exploit thus depends on two distinct validation gaps.
An advisory traces image payloads with EPS content through permissive Pillow format detection into Ghostscript, and reports execution in a tested vLLM 0.30.0 environment with Ghostscript 10.03.0. vLLM 0.32.0 restricts formats; Ghostscript 10.03.1 fixed the underlying interpreter issue. The project traces the media loader and demonstrates a marker under specific dependency versions. A universal live Internet-to-shell result in all model deployments is not established.
Restrict accepted image formats by content and decoder capabilities, and patch or remove vulnerable Ghostscript. Checking only the declared MIME type does not prevent format reinterpretation. This is a chained-media-dependency boundary, not evidence of a flaw in the model weights. Primary evidence.
Additional evidence and trust boundary
The flaw is an input-format crossing: a request labels bytes as PNG, but Pillow reads the actual EPS file signature and invokes Ghostscript. The model server's MIME handling allowed untrusted content to reach an interpreter with a known separate vulnerability. A fix must restrict accepted formats before decoding; patching Ghostscript separately removes the documented execution primitive. Systems without vulnerable Ghostscript do not meet the reported RCE preconditions. Supporting record.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 26, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-38The vLLM author reproduced marker-command execution through ImageMediaIO.load_base64() on vLLM 0.30.0 with vulnerable Ghostscript 10.03.0, but traced rather than executed the full model-backed HTTP request path.supported
Basis: reported finding
- supportsvLLM advisory: EPS disguised as PNG reaches Ghostscript via Pillowprimary disclosure
GHSA-h3rc-j82p-2c3h, Proof of Concept and Environment, loader-level execution versus HTTP
CLM-CP21-VLLM-GHOSTSCRIPT-EPS-1An advisory traces image payloads with EPS content through permissive Pillow format detection into Ghostscript, and reports execution in a tested vLLM 0.30.0 environment with Ghostscript 10.03.0. vLLM 0.32.0 restricts formats; Ghostscript 10.03.1 fixed the underlying interpreter issue.supported
Basis: reported finding
- supportsvLLM advisory: EPS disguised as PNG reaches Ghostscript via Pillowprimary disclosure
Description, reproduction environment, Ghostscript dependency and fixed versions
Implications
This is a chained-media-dependency boundary, not evidence of a flaw in the model weights.
Controls and mitigations
- Restrict accepted image formats by content and decoder capabilities, and patch or remove vulnerable Ghostscript. Checking only the declared MIME type does not prevent format reinterpretation.
Unknowns and contradictions
- The project traces the media loader and demonstrates a marker under specific dependency versions. A universal live Internet-to-shell result in all model deployments is not established.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196