Safety vulnerability ID: 76270
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of the vllm-project vLLM package are vulnerable to Remote Code Execution (RCE). The MessageQueue.dequeue() API function fails to sanitize user input before deserialization, using pickle.loads to parse received socket data, directly leading to arbitrary code execution. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted malicious pickle payload to the MessageQueue service, resulting in the execution of arbitrary code with the same privileges as the vLLM application process.
Latest version: 0.2.36
An open platform for training, serving, and evaluating large language model based chatbots.
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application