Description

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat.py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl.py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository's default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. The issue is fixed in version 0.28.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:47.953Z",
  "pubdate": "2026-09-26T14:16:47.953Z",
  "executiveSummary": "This vulnerability involves a failure in revision propagation within vLLM, specifically affecting FunAudioChat and Tarsier2 architectures in versions 0.22.1 through 0.28.0.\nThe core issue is a supply-chain integrity failure where operator-supplied model revision pins (--revision / --code-revision) are ignored during the loading of specific Hugging Face artifacts, such as WhisperFeatureExtractor, speech_tokenizer, and Qwen2VLConfig.\nThis allows downstream deployments to inadvertently fetch artifacts from the upstream repository's default branch rather than the security-reviewed pinned revision.\nWhile this does not grant remote code execution or bypass trust_remote_code=False, it significantly undermines deployment reproducibility and model integrity.\nAn attacker or an upstream provider altering the default branch of a model repository can silently inject behavior-modifying changes into pinned production environments.\nThis risk is categorized as an improper limitation of path or version constraints during artifact resolution, residual to the previously addressed CVE-2026-47155.",
  "technicalDetails": "The vulnerability originates from a failure to propagate the user-defined --revision or --code-revision flags to specific PreTrainedTokenizerFast and configuration loading routines within vLLM model executors.\nIn vllm/model_executor/models/funaudiochat.py, the WhisperFeatureExtractor and speech_tokenizer loads fail to respect the user-supplied revision, causing them to default to the Hugging Face hub's main branch head.\nSimilarly, in vllm/model_executor/models/qwen2_vl.py, the Qwen2VLConfig.from_pretrained call utilized by Tarsier2ProcessingInfo fails to implement the requested pinning.\nThe exploit flow begins when an operator pins a deployment to a specific, cryptographically verified model revision to ensure deterministic inference behavior.\nDespite this explicit configuration, the vLLM engine performs a secondary fetch of the audio preprocessing and tokenizer artifacts, which are resolved via standard Hugging Face repository defaults due to the missing parameter propagation.\nConsequently, if an upstream model provider pushes a change to the default branch of the underlying model repository, the vLLM instance will dynamically fetch and apply these changed artifacts during model loading or initialization.\nThis effectively renders the pinning mechanism useless for these components, as the deployed model's behavior shifts away from the verified baseline.\nThe vulnerability affects versions 0.22.1 through 0.28.0. It does not constitute a Remote Code Execution (RCE) vector, nor does it circumvent security controls related to trust_remote_code=False.\nPost-exploitation, an attacker with influence over the upstream model repository can cause silent shifts in inference accuracy, preprocessing logic, or tokenizer output by modifying artifacts on the default branch, potentially leading to model denial-of-service, unintended hallucinations, or data processing errors in downstream applications that rely on consistent, pinned behavior."
}