CVE-2026-22807
HIGHvllm 0.10.1-0.13.0 - Remote Code Execution via Hugging Face auto_map Dynamic Module Loading
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2026-22807. PoCs published by XiaomingX, otakuliu.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2026-22807, demonstrating a supply chain attack via AI model loading. The exploit leverages a TOCTOU (Time-of-Check Time-of-Use) vulnerability in AI inference frameworks, where malicious code is executed before security checks are performed.
Description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attacker-controlled Python code in a model repo/path to execute at server startup. An attacker who can influence the model repo/path (local directory or remote Hugging Face repo) can achieve arbitrary code execution on the vLLM host during model load. This happens before any request handling and does not require API access. Version 0.14.0 fixes the issue.
Exploits (2)
This repository contains a functional proof-of-concept exploit for CVE-2026-22807, demonstrating a supply chain attack via AI model loading. The exploit leverages a TOCTOU (Time-of-Check Time-of-Use) vulnerability in AI inference frameworks, where malicious code is executed before security checks are performed.
This PoC demonstrates a supply chain attack (CVE-2026-22807) exploiting a TOCTOU vulnerability in AI model loaders, where remote code execution occurs before trust checks are enforced.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H