Skip to content

CVE-2026-22807: Verified Repro With Script Download

CVE-2026-22807: vLLM RCE via auto map dynamic module loading

Download script Open in Codespaces

CVE-2026-22807 is verified against vllm · pip. Affected versions: >= 0.10.1, < 0.14.0. Vulnerability class: RCE. This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00078.

REPRO-2026-00078 vllm · pip RCE Jan 22, 2026 CVE entry ↗ .txt
Severity
HIGH
CVSS
8.8
Confidence
HIGH
Reproduced in
19m 50s
Tool calls
280
01 · Overview

What Is CVE-2026-22807?

CVE-2026-22807 is a high-severity remote code execution vulnerability in vLLM, caused by loading Hugging Face auto_map dynamic modules during model resolution without honoring the trust_remote_code setting. Pruva reproduced it (reproduction REPRO-2026-00078).

02 · Severity & CVSS

CVE-2026-22807 Severity & CVSS Score

CVE-2026-22807 is rated high severity, with a CVSS base score of 8.8 out of 10.

HIGH threat level
8.8 / 10 CVSS base
Weakness CWE-94 — Improper Control of Generation of Code ('Code Injection')

High — serious impact or readily exploitable. Prioritize remediation.

03 · Affected Versions

Affected vllm Versions

vllm · pip versions >= 0.10.1, < 0.14.0 are affected.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2026-22807

$ pruva-verify REPRO-2026-00078
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00078/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2026-22807

Reproduced by Pruva's autonomous agents — 298 tool calls over 21 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 435 events · 298 tool calls · 21 min
21 minDuration
298Tool calls
130Reasoning steps
435Events
Agent activity over 21 min
Support
5
Repro
423
0:0020:30

Root Cause and Exploit Chain for CVE-2026-22807

try_get_class_from_dynamic_module delegates to Transformers get_class_from_dynamic_module without calling resolve_trust_remote_code, and the registry passes no trust_remote_code value when iterating auto_map entries.

CVE-2026-22807 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:001:56
0:00
session startedgpt-5-codex · ghsa-2pc9-4j83-qjmr · f944394c
0:15
extract_facts
output{"stored": true, "fact_count": 2}
0:15
0:17
supportrepro
0:17
supportrepro
0:19
0:19
0:19
0:20
$ls -la
✓
total 28
drwxr-xr-x 6 root root 4096 Jan 22 08:23 .
drwxr-xr-x 4 root root 4096 Jan 22 08:23 ..
drwxr-xr-x 3 root root 4096 Jan 22 08:22 artifacts
drwxr-xr-x 2 root root 4096 Jan 22 08:22 coding
-rw-r--r-- 1 root root  687 Jan 22 08:23 handoffs.jsonl
drwxr-xr-x 2 root root 4096 Jan 22 08:23 logs
drwxr-xr-x 2 root root 4096 Jan 22 08:22 repro
0:20
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 28\\ndrwxr-xr-x 6 root root 4096 Jan 22 08:23 .\\ndrwxr-xr-x 4 root root 4096 Jan 22 08:23 ..\\ndrwxr-xr-x 3 root root 4096 Jan 22 08:22 artifacts\\ndrwxr-xr-x 2 root ro"}
0:23
$cat ticket.md
✓
# GHSA-2pc9-4j83-qjmr: vLLM affected by RCE via auto_map dynamic module loading during model initialization

## Description
# Summary

vLLM loads Hugging Face `auto_map` dynamic modules during model resolution **without gating on `trust_remote_code`**, allowing attacker-controlled Python code in a model repo/path to execute at server startup.

---
0:23
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"# GHSA-2pc9-4j83-qjmr: vLLM affected by RCE via auto_map dynamic module loading during model initialization\\n\\n## Description\\n# Summary\\n\\nvLLM loads Hugging Face `auto_m"}
0:25
0:25
$ls -la artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249/repo
✓
ls: cannot access 'artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249/repo': No such file or directory
0:25
$
✓
{"output":"{\"returncode\": 2, \"stdout\": \"\", \"stderr\": \"ls: cannot access 'artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249/repo': No such file or directory\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-2pc9-"}
0:27
0:27
$ls -la artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249
✓
ls: cannot access 'artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249': No such file or directory
0:27
$
✓
{"output":"{\"returncode\": 2, \"stdout\": \"\", \"stderr\": \"ls: cannot access 'artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249': No such file or directory\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-2pc9-4j83-"}
0:31
0:31
$ls -la artifacts
✓
total 12
drwxr-xr-x 3 root root 4096 Jan 22 08:22 .
drwxr-xr-x 6 root root 4096 Jan 22 08:23 ..
drwxr-xr-x 2 root root 4096 Jan 22 08:22 prepped
0:31
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 12\\ndrwxr-xr-x 3 root root 4096 Jan 22 08:22 .\\ndrwxr-xr-x 6 root root 4096 Jan 22 08:23 ..\\ndrwxr-xr-x 2 root root 4096 Jan 22 08:22 prepped\\n\", \"stderr\": \"\", \"cwd\""}
0:32
0:32
$ls -la artifacts/prepped
✓
total 8
drwxr-xr-x 2 root root 4096 Jan 22 08:22 .
drwxr-xr-x 3 root root 4096 Jan 22 08:22 ..
0:32
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 22 08:22 .\\ndrwxr-xr-x 3 root root 4096 Jan 22 08:22 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-2pc9-4j83-q"}
0:34
0:34
$find /home/user/pruva -maxdepth 4 -type d -name repo
0.2s✓
0:34
$
0.2s✓
{"output":"{\"returncode\": 0, \"stdout\": \"\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249/ghsa-2pc9-4j83-qjmr\"}"}
0:44
0:44
0:44
$git --version
✓
git version 2.43.0
0:44
$python3 --version
✓
Python 3.11.14
0:44
0:44
0:49
0:49
$mkdir -p /home/user/pruva/work
✓
0:49
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-2pc9-4j83-qjmr/20260122-082249/ghsa-2pc9-4j83-qjmr\"}"}
0:51
1:51
$git clone https://github.com/vllm-project/vllm.git /home/user/pruva/work/vllm
60.0s✓
Cloning into '/home/user/pruva/work/vllm'...
1:51
$
60.0s✓
{"output":"{\"returncode\": null, \"stdout\": \"\", \"stderr\": \"Cloning into '/home/user/pruva/work/vllm'...\\n\", \"error\": \"Command timed out after 60.0 seconds\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-2pc9-4j83-q"}
1:56

Artifacts and Evidence for CVE-2026-22807

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2026-22807

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2026-22807 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2026-22807

How does the CVE-2026-22807 attack lead to code execution?

Because model resolution happens at server startup, an attacker who controls (or can get a victim to load) a Hugging Face model repository with a malicious auto_map entry can get that entry's Python code executed on the vLLM server as it starts up, before any trust_remote_code=False intent would normally be honored.

Which vLLM versions are affected by CVE-2026-22807?

Versions >= 0.10.1, < 0.14.0 are documented as affected in this reproduction.

How can I reproduce CVE-2026-22807?

Download the verified script from this page and run it in an isolated environment against vllm >=0.10.1,<0.14.0. Point the server at a Hugging Face model repository whose config references an auto_map entry pointing to attacker-controlled Python code, load/serve the model, and confirm the code executes at server startup regardless of the trust_remote_code setting.
11 · References

References for CVE-2026-22807

Authoritative sources for CVE-2026-22807 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.