Arbitrary Code Execution Vulnerability in vLLM Inference Engine by vLLM Project

CVE-2026-41523

What is CVE-2026-41523?

The vLLM inference and serving engine for large language models contains a vulnerability that allows unauthenticated attackers to execute arbitrary code on the server. This occurs due to an assertion-based security check within the activation function's loading mechanism when vLLM operates in Python optimized mode (using 'python -O' or setting 'PYTHONOPTIMIZE=1'). By leveraging this flaw, attackers can publish a malicious HuggingFace model to gain unauthorized access and control over the server environment. This issue has been addressed in version 0.22.0, making it crucial for users to update their installations promptly.

References