{"repro_id":"REPRO-2026-00078","version":6,"title":"vLLM RCE via auto_map dynamic module loading","repro_type":"security","status":"published","severity":"high","description":"vLLM loads Hugging Face auto_map dynamic modules during model resolution without honoring trust_remote_code, allowing attacker-controlled code to execute at server startup.","root_cause":"try_get_class_from_dynamic_module delegates to Transformers get_class_from_dynamic_module without calling resolve_trust_remote_code, and the registry passes no trust_remote_code value when iterating auto_map entries.","ghsa_id":"GHSA-2pc9-4j83-qjmr","cve_id":"CVE-2026-22807","source_url":"https://github.com/advisories/GHSA-2pc9-4j83-qjmr","package":{"name":"vllm","ecosystem":"pip","affected_versions":">= 0.10.1, < 0.14.0"},"reproduced_at":"2026-01-22T08:41:28.332495+00:00","duration_secs":1190.0,"tool_calls":280,"quality":{"confidence":"high","idempotent_verified":true,"community_verifications":0},"evidence":[{"content":"loaded <class transformers_modules.tmp_model.malicious.MyConfig>\npwned_exists True","description":"The auto_map loader executed the malicious module and created marker files","title":"Malicious code executed on vulnerable version","type":"log_excerpt"},{"content":"loaded None\npwned_exists False","description":"The fixed version returns None and does not execute the malicious code","title":"Fixed version blocks execution","type":"log_excerpt"}],"key_moments":[{"description":"Analyzed vLLM auto_map RCE vulnerability from GHSA-2pc9-4j83-qjmr","index":0,"time":0,"title":"Ticket analysis","type":"analysis_start"},{"description":"Handoff from support to repro agent","index":3,"time":17067,"title":"support→repro","type":"handoff"},{"description":"Malicious module executed via auto_map loading","index":150,"time":750000,"title":"Code execution demonstrated","type":"poc_created"},{"description":"Fixed version v0.14.0 blocks execution via trust_remote_code gating","index":300,"time":960000,"title":"Fix verified","type":"confirmation"}],"published_at":"2026-01-22T08:41:40.828763+00:00","retracted":false,"artifacts":[{"path":"bundle/repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":4353,"category":"reproduction_script"},{"path":"bundle/repro/rca_report.md","filename":"rca_report.md","size":2735,"category":"analysis"},{"path":"bundle/ticket.md","filename":"ticket.md","size":2215,"category":"ticket"},{"path":"bundle/logs/attempt1.log","filename":"attempt1.log","size":85,"category":"log"},{"path":"bundle/logs/attempt2.log","filename":"attempt2.log","size":18,"category":"log"},{"path":"bundle/logs/attempt3_fixed.log","filename":"attempt3_fixed.log","size":31,"category":"log"},{"path":"bundle/logs/summary.log","filename":"summary.log","size":68,"category":"log"},{"path":"bundle/logs/tool_01_list_memory_items.log","filename":"tool_01_list_memory_items.log","size":186,"category":"log"}]}