vLLM Library Arbitrary Code Execution Vulnerability via Unsafe Model Loading

A vulnerability in the vLLM library, specifically in the model weight loading functionality, allows for arbitrary code execution. This issue arises because the library uses the torch.load function to deserialize model weights from Hugging Face, with the default setting of weights_only parameter allowing potentially harmful code to execute during the unpickling process. The vulnerability affects vLLM versions through 0.7.0 and has been addressed in version 0.7.0.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the machine running the affected vLLM version.

Reproduction

The vulnerability can be reproduced by loading a malicious model checkpoint from Hugging Face using vLLM's model weight loading function. This can be done by setting the weights_only parameter to False, which is the default behavior.

Remediation

Users can update to vLLM version 0.7.0 or later, where this vulnerability has been fixed.