vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

Summary

An untrusted multimodal request can set mm_processor_kwargs.code_revision. When vLLM serves a model whose Hugging Face processor uses dynamic auto_map code and the operator enabled --trust-remote-code, this request value reaches AutoProcessor.from_pretrained and selects the Python revision imported by Transformers.

This lets a client replace the operator-reviewed processor module with code from another revision of the same model repository. The operator-selected model/data revision remains pinned; only the executed processor code changes.

Importing a Python module is arbitrary code execution in the vLLM API/renderer process. The PoC below demonstrates this with an import-time filesystem write. It is fully offline and does not require a GPU, model weights, or changes to a real Hub repository.

Affected snapshot

• Repository: vllm-project/vllm
• Verified commit: 570735520942b6428ae98f1eb442c6d88adae55e
• Verified with Transformers 5.15.0 and 5.16.1
• Affected release range has not been bisected

Affected configuration

The vulnerable path exists when all of the following are true:

1. The served model's processor uses dynamic auto_map.AutoProcessor code.
2. The operator enabled trust_remote_code.
3. The server can fetch the request-selected revision, or it is already cached.
4. The attacker can create or otherwise control a revision in the served model repository. An example is a Hugging Face community pull-request ref when that repository permits them.