GHSA-x567-49g5-p4cf

## Summary vLLM's `/v1/responses` endpoint accepts request-level `chat_template_kwargs`, but does not apply the `--trust-request-chat-template` gate that protects Chat Completions, render, tokenize, and pooling paths. When the server is run with the documented default `trust_request_chat_template=False` and no explicit `--chat-template`, a Responses request can pass: ```json {"chat_template_kwargs": {"chat_template": "<attacker Jinja template>"}} ``` That key is preserved by `ChatParams.get_apply_chat_template_kwargs()` and then bound as the `chat_template` parameter to the shared HF renderer. Prior vLLM advisories establish that request-controlled Jinja chat templates can cause CPU/memory exhaustion. This report covers the current-head Responses sibling path missed by the earlier fixes. ## Technical Details The shared OpenAI frontend has a validation helper that rejects request-supplied chat templates unless the trust flag is enabled. It explicitly checks both top-level `chat_template` and `chat_template_kwargs["chat_template"]`. Responses is a separate serving path: - `vllm/entrypoints/openai/responses/protocol.py` exposes `chat_template_kwargs`. - `ResponsesRequest.build_chat_params()` merges request kwargs. - `OpenAIServingResponses._effective_chat_template_kwargs()` uses those kwargs. - `ChatParams.get_apply_chat_template_kwargs()` preserves a request `chat_template` key when the server chat template is `None`. - `vllm/renderers/hf.py` unpacks the result into `safe_apply_chat_template`. There is no equivalent trust gate in `vllm/entrypoints/openai/responses/serving.py`. ## Impact An authenticated caller who can submit `/v1/responses` requests can supply a request-controlled Jinja chat template despite the trust flag being disabled. The expected fixed behavior is the same as Chat Completions: reject `chat_template_kwargs["chat_template"]` unless the server was started with `--trust-request-chat-template`. ## Suggested Fix - Add `trust_request_chat_template` to `OpenAIServingResponses`. - Pass `args.trust_request_chat_template` when constructing the Responses serving object. - Reject `request.chat_template_kwargs["chat_template"]` before rendering when trust is false. - Keep ordinary kwargs such as `enable_thinking` working. - Add regression tests for default-deny and opt-in-allow behavior on `/v1/responses`. ## Affected Package/Versions Source sweep found the affected shape in: - `v0.16.0` - `v0.18.0` - `v0.20.0` - `v0.21.0` - `v0.22.0` - `v0.22.1` - `v0.23.0` - current checkout `470229c37efaf69c86e8bc97482b0b1ff7551c65` - current `origin/main` `b3f0a0a0df76dda92ec4b2c9335f77e84adad911` Suggested affected range: ```text >= 0.16.0, <= 0.23.0 ``` ## Appendix: Duplicate Research This is related to, but distinct from: - `GHSA-6fvq-23cw-5628` / `CVE-2025-61620` - `GHSA-69j4-grxj-j64p` / `CVE-2025-62426` Those advisories establish the security impact of request-controlled Jinja templates and `chat_template_kwargs`, but they cover older Chat Completions/tokenize implementations. This report covers a current `/v1/responses` sibling path that still lacks the trust gate. Local prior submissions this report..029 do not cover this root cause. This advisory was fixed in [MR50300](https://github.com/vllm-project/vllm/pull/50300).