CVE-2025-66448
Published: 01 December 2025
Summary
CVE-2025-66448 is a high-severity Code Injection (CWE-94) vulnerability in Vllm Vllm. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-18 (Mobile Code) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely patching of vLLM to version 0.11.1 or later, which fixes the remote code execution in Nemotron_Nano_VL_Config.
Restricts execution of mobile code, directly preventing the dynamic fetching and instantiation of Python code from remote repositories via auto_map entries in model configs.
Enforces validation of model configuration inputs like auto_map to block malicious remote code fetches that bypass trust_remote_code settings.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via crafted model configurations (T1203 Exploitation for Client Execution), facilitates supply chain compromise through malicious model repositories and dependencies (T1195.001), and directly results in arbitrary Python code execution (T1059.006).
NVD Description
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry,…
more
the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.
Deeper analysisAI
CVE-2025-66448 is a remote code execution vulnerability in vLLM, an inference and serving engine for large language models, affecting versions prior to 0.11.1. The issue resides in the Nemotron_Nano_VL_Config class, where loading a model configuration containing an auto_map entry triggers resolution via get_class_from_dynamic_module, which fetches and instantiates Python code from a remote repository specified in the auto_map string. This execution occurs even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config, bypassing intended security controls.
An attacker can exploit this by publishing a seemingly benign frontend repository with a config.json file that includes an auto_map pointing to a separate malicious backend repository. A victim loading the frontend model config will silently fetch and execute the backend's arbitrary Python code on their host. Per the CVSS v3.1 score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H), exploitation requires network access, high attack complexity, low privileges, and user interaction, but yields high impacts on confidentiality, integrity, and availability, classified under CWE-94 (code injection).
The vulnerability is addressed in vLLM version 0.11.1. Official mitigation details are available in the project's security advisory at GHSA-8fr4-5q9j-m8gm, the fixing pull request at github.com/vllm-project/vllm/pull/28126, and the commit ffb08379d8870a1a81ba82b72797f196838d0c86, which practitioners should review for patch implementation guidance.
This flaw highlights risks in AI/ML inference engines handling untrusted model configurations from remote sources, with no reported real-world exploitation as of the CVE publication on 2025-12-01.
Details
- CWE(s)