The vLLM inference engine contains a critical remote code execution vulnerability that allows an attacker to execute arbitrary Python code on the host system by providing a malicious model configuration.

This vulnerability involves improper control of code generation (CWE-94) within the Nemotron_Nano_VL_Config class. The application automatically resolves and instantiates classes via auto_map entries in model configurations, which triggers remote Python code execution even when the user has explicitly disabled remote code trust.

The ability for an unauthenticated or low-privileged attacker to achieve remote code execution on an inference server poses a catastrophic risk to organizational data and infrastructure. Given the CVSS score of 7.1, this flaw could lead to full system compromise, unauthorized access to sensitive large language model data, and potential lateral movement within the network.

Immediate Action: Update the vLLM package to version 0.11.1 or later immediately to resolve the insecure configuration loading logic.

Proactive Monitoring: Review system logs for unexpected outbound network connections initiated by the vLLM process, as these may indicate attempts to fetch and execute external malicious repositories.

Compensating Controls: Implement strict egress filtering on the inference server to prevent unauthorized connections to unknown repositories until the update can be applied.

Public Exploit Available: Unknown

This vulnerability represents a significant security oversight in how vLLM handles external model configurations. Security teams must prioritize upgrading to version 0.11.1 to close this execution vector. Failure to patch allows attackers to bypass security settings intended to prevent remote code execution, making immediate remediation essential to maintaining the integrity of the AI infrastructure.