CVE-2026-73560
Fixed in a distro release EPSS <1%CVSS 6.5
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.
Products: vllm-project vllm
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | vllm | 0.26.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | kserve-huggingfaceserver-cuda-13.3 | no fix |
| Chainguard | lmcache-cuda-12.8 | 0 |
| Chainguard | nemo-rl-cuda-13.0-vllm | no fix |
| Chainguard | py3.10-vllm-cuda-12.4 | no fix |
| Chainguard | py3.12-vllm-cuda-12.4 | no fix |
| openSUSE Tumbleweed | python-vllm | 0.32.0-1.1 |