An untrusted request supplies mm_processor_kwargs including code_revision. The multimodal processor may load repository code from the requested revision rather than the server-pinned version, crossing from inference data into server-side Python execution. CVE-2026-114053 documents request-controlled mm_processor_kwargs.code_revision affecting the vLLM…
Inspect the ClaimsCase · DiggingBeagle record
vLLM request metadata could override pinned model code revision for multimodal processing
A remote inference parameter reached a code-loading decision that operators may have assumed was fixed by server configuration.
Scope
The system must enable the affected model loading and trust-remote-code behavior. No published fleet-wide victim count follows from the advisory.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The reviewed advisory traces request-controlled mm_processor_kwargs.code_revision into Hugging Face AutoProcessor dynamic Python imports and provides an offline PoC. Preconditions include trust_remote_code and dynamic auto_map; patched vLLM is 0.31.0. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-019-A · CLM-CP22-019-B · CLM-ENRICH-20261028-016 · vLLM code_revision override remote-code-execution advisory
At a glance
Which downstream inference deployments accept the parameter through public routes and the exact vulnerable model list remain unverified here.
Limits and uncertaintyFull account
An untrusted request supplies mm_processor_kwargs including code_revision. The multimodal processor may load repository code from the requested revision rather than the server-pinned version, crossing from inference data into server-side Python execution.
CVE-2026-114053 documents request-controlled mm_processor_kwargs.code_revision affecting the vLLM model-code trust boundary. The advisory describes remote code execution conditioned on the vulnerable dynamic code-loading path, not arbitrary execution on every vLLM installation. Primary evidence.
The system must enable the affected model loading and trust-remote-code behavior. No published fleet-wide victim count follows from the advisory.
Disallow request-controlled model code revisions, pin audited model commits and validate multimodal kwargs against server-owned allowlists.
Claims & evidence
CLM-CP22-019-ACVE-2026-114053 documents request-controlled mm_processor_kwargs.code_revision affecting the vLLM model-code trust boundary.supported
Basis: reported finding
- supportsvLLM code_revision override remote-code-execution advisoryprimary disclosure
Advisory title and vulnerability description
CLM-CP22-019-BThe advisory describes remote code execution conditioned on the vulnerable dynamic code-loading path, not arbitrary execution on every vLLM installation.supported
Basis: reported finding
- supportsvLLM code_revision override remote-code-execution advisoryprimary disclosure
Advisory; affected conditions and patch guidance
CLM-ENRICH-20261028-016The advisory requires a dynamic auto_map processor and enabled trust_remote_code; it identifies 0.31.0 as patched and demonstrates import-time execution in an offline proof of concept.supported
Basis: reported finding
- supportsvLLM code_revision override remote-code-execution advisoryprimary disclosure
Affected configuration, Summary and Patched versions, GHSA-h3rc-6mm3-gc2m
Controls and mitigations
- Disallow request-controlled model code revisions, pin audited model commits and validate multimodal kwargs against server-owned allowlists.
Unknowns and contradictions
- Which downstream inference deployments accept the parameter through public routes and the exact vulnerable model list remain unverified here.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199