This vulnerability occurs when the operator‑supplied model revision pin (--revision / --code‑revision) fails to be propagated to several Hugging Face artifact loads in the FunAudioChat and Tarsier2 architectures of vLLM. As a result, deployments that rely on a pinned revision continue to resolve processor, tokenizer, and configuration artifacts from the repository’s default revision. This flaw undermines the reproducibility and integrity of the deployment; a change to the upstream default branch can silently alter audio preprocessing, speech tokenizing, or Tarsier2 configuration. The issue does not provide remote code execution or bypass trust_remote_code False, but it does allow unintended behavioral changes. The CVSS score of 8.3 reflects the high impact of such integrity failures.

vLLM provided by vllm‑project is affected in all releases from version 0.22.1 through 0.28.0 inclusive. The defect specifically affects the FunAudioChat and Tarsier2 model architectures of the library. Any deployment that loads these models and specifies a revision pin is potentially impacted. Operations using earlier or later releases are not affected.

The CVSS score of 8.3 indicates a high severity risk. The EPSS score is not available, so the temporal exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog. The likelihood of exploitation is contingent on an attacker’s ability to modify the upstream default branch or otherwise influence the artifacts retrieved from Hugging Face. Since the flaw only permits the use of unrevised artifacts, the attack vector is inferred to be either local (principally when the deployment’s code is compromised) or via supply‑chain manipulation. Nevertheless, organizations that rely on the integrity of pinned deployments should treat this as a significant concern.