An assert statement used for a security check in vLLM’s activation function loading was bypassed, enabling an attacker to inject and execute arbitrary code. The flaw is classified as a code injection weakness (CWE-94) and an input validation issue (CWE-617). When executed in Python optimized mode, the assert is removed, and the vulnerable path is fully exposed, allowing a potential attacker to craft a malicious HuggingFace model that triggers the vulnerable code path.

vLLM version 0.21.x and earlier from the vllm-project vllm product are affected. The vulnerability was fixed in version 0.22.0. Any deployment that imports models from public HuggingFace repositories while running with Python optimise flags (python -O or PYTHONOPTIMIZE=1) is at risk. No other products or vendors are reported as affected.

The flaw carries a CVSS score of 7.5, indicating a high severity. Because it is solely exploitable in optimized mode, the direct path to exploitation is limited to deployments that enable that mode and load external models, but such a configuration is commonly used in production. The EPSS score is not available, so the historical exploitation probability is unknown; however, the fact that the vulnerability was published and tracked via a public advisory suggests confidence that it could be exploited if not patched. The vulnerability is not listed in the CISA KEV catalogue, but the potential for uncontrolled code execution warrants immediate attention.