The report
A model server may pin the code revision it intends to load, yet still accept an inference parameter that reaches the same loading decision. That is the failure described in vLLM's CVE-2026-114053: a request-provided mm_processor_kwargs.code_revision could override the operator's expected model-code revision in a vulnerable multimodal processing path. Advisory mechanism.
The demonstrated attack depends on a processor that uses a dynamic auto_map implementation and a deployment with trust_remote_code enabled. The published proof shows execution during processor import in a controlled environment; it does not establish arbitrary code execution against every vLLM configuration. Preconditions and patch.
Affected releases include 0.7.3 through the 0.30.x series, with version 0.31.0 identified as corrected in the advisory. The direct mitigation is to use the fixed version and ensure that request payloads cannot select a code origin outside an operator-pinned allowlist. Disabling unnecessary dynamic model code is an additional boundary, but it does not replace patch validation. Maintainer-advisory evidence.
This is not primarily a malicious-prompt story. The unsafe transition was from untrusted structured request metadata into executable model-processing configuration. An input may be syntactically valid inference metadata while still being unauthorized to change what code the service imports. Testing should therefore compare the configured revision with the revision actually loaded after a hostile request, rather than only checking whether the response body looks normal.