vLLM is an inference and serving platform for large language models that relies on accurate revision pinning to ensure that only reviewed code and model artifacts are executed. The vulnerability causes a drift where pinned deployments that specify a revision or code revision can still load dynamic code, weight files, image processors, or sibling artifacts from the default or an unpinned revision. As a result, operators might believe they are serving a secure, reviewed model while the system unintentionally incorporates potentially compromised artifacts. This supply‑chain integrity issue aligns with CWE‑345 and CWE‑829 and could allow an adversary to insert malicious code or alter model behavior without detection.

All installations of vllm-project vllm running a version earlier than 0.22.0 are subject to this flaw. The affected component is the artifact loading subsystem that resolves code, weight, and processor revisions.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of 0.00146 (<1%) suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves compromising the deployment configuration or gaining control over the artifact repository from which the dynamic artifacts are loaded, allowing an attacker to inject or modify code outside the intended pinned revision. Operators should therefore treat this issue as significant due to its potential to undermine model integrity.