Skip to content
Verified reproduction

CVE-2026-22807: vLLM RCE via auto_map dynamic module loading

Download script Open in Codespaces

CVE-2026-22807 is verified against vllm · pip affected versions: >= 0.10.1, < 0.14.0 vulnerability class: RCE This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00078.

REPRO-2026-00078 vllm · pip RCE Jan 22, 2026 CVE entry .txt
Severity HIGH
Confidence HIGH
Reproduced in 19m 50s
Tool calls 280
Affected >= 0.10.1, < 0.14.0
01 · Reproduce
Download script Open in Codespaces →
$ pruva-verify REPRO-2026-00078
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00078/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
02 · The vulnerability

vLLM loads Hugging Face auto_map dynamic modules during model resolution without honoring trust_remote_code, allowing attacker-controlled code to execute at server startup.

03 · Root cause 
try_get_class_from_dynamic_module delegates to Transformers get_class_from_dynamic_module without calling resolve_trust_remote_code, and the registry passes no trust_remote_code value when iterating auto_map entries.
04 · Reproduction transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.

Loading session...
05 · Artifacts

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available