vLLM versions 0.7.3 through 0.30.x forward the request‑supplied mm_processor_kwargs.code_revision value to Transformers AutoProcessor.from_pretrained when trust_remote_code is enabled. Because that code_revision can point to any revision in the served model repository, an attacker can have the API load and execute arbitrary Python code, resulting in full control of the vLLM API process. This flaw satisfies CWE‑94, allowing an attacker to run arbitrary code with the privileges of the vLLM service.

All installations of the vLLM project’s vLLM package from version 0.7.3 up to, but not including, 0.31.0 are affected. The vulnerable code exists in the vllm‑package code base and affects all deployments that expose the unauthenticated /tokenize endpoint and have trust_remote_code enabled.

The advisory assigns a CVSS score of 9.2, indicating high severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation but the impact remains catastrophic if exploited. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP request to /tokenize with a crafted mm_processor_kwargs.code_revision that points to a malicious model‑repository revision; the attacker must already control or compromise the repository hosting the model code.