A dependency confusion flaw in vLLM’s Dockerfile allows an attacker to inject malicious code by uploading a package with the same name as a private dependency to PyPI. During the Docker build, the Dockerfile pulls the package from an untrusted index and installs it with a globally configured unsafe best‑match strategy. If the attacker succeeds, arbitrary code can run as root, and all resulting container images can be back‑doored, exposing prompts, credentials, and model data.

All installations of vLLM before version 0.22.1 that use the default Dockerfile are susceptible. Users running Docker builds of the vLLM engine with the flashinfer‑jit‑cache package via the custom index are impacted.

The vulnerability carries a CVSS score of 8.8, indicating high risk. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the KEV catalog. Exploitation requires the attacker to upload a malicious flashinfer‑jit‑cache package to PyPI, a straightforward step for any PyPI‑registered user, making the attack path realistic. Once the malicious package is pulled during a Docker build, the attacker gains root access inside the image, enabling persistent compromise of all containers built from that image.