GHSA-cj47-qj6g-x7r4

vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-9053

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	vllm	<= 0.6.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-9053 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2025-222.yaml web
https://github.com/vllm-project/vllm package
https://huntr.com/bounties/75a544f3-34a3-4da0-b5a3-1495cb031e09 web