# Root Cause Analysis Report

## Summary
vLLM 0.13.0 loads Hugging Face `auto_map` dynamic modules during model resolution without honoring `trust_remote_code`, so Python code embedded in a model repository is executed as soon as the model is initialized. The vulnerable helper `try_get_class_from_dynamic_module` delegates directly to Transformers’ `get_class_from_dynamic_module` without calling `resolve_trust_remote_code`, and the registry passes no `trust_remote_code` value when iterating `auto_map`, allowing attacker-controlled modules to run at server startup.

## Impact
- **Component:** `vllm/transformers_utils/dynamic_module.py` and `vllm/model_executor/models/registry.py`
- **Affected versions:** vLLM >= 0.10.1, < 0.14.0 (verified on v0.13.0)
- **Risk:** High. An attacker who can control the model repository/path can achieve arbitrary code execution on the vLLM host during model load, before any request handling.

## Root Cause
- In v0.13.0, `try_get_class_from_dynamic_module` calls `transformers.dynamic_module_utils.get_class_from_dynamic_module` without checking `trust_remote_code`.
- The model registry resolves `auto_map` entries and calls the helper without any `trust_remote_code` parameter, so untrusted remote/local module code executes.
- Fix commit: `78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5` (adds `trust_remote_code` gating via `resolve_trust_remote_code` and passes the flag from registry).

## Reproduction Steps
1. Run `repro/reproduction_steps.sh`.
2. The script creates a malicious model repo with `auto_map` entries and a module that writes marker files, then loads it using the vulnerable helper (v0.13.0) and the fixed helper (v0.14.0).
3. Expected evidence: `logs/pwned_attempt1.txt` and `logs/pwned_attempt2.txt` exist, while `logs/pwned_fixed.txt` does **not**.

## Evidence
- Logs:
  - `logs/attempt1.log` and `logs/attempt2.log` show the vulnerable helper loading the malicious class and marker files being written.
  - `logs/attempt3_fixed.log` shows the fixed helper returning `None` and no marker file being created.
  - `logs/summary.log` summarizes success state.
- Environment: Python 3.11 with `transformers==4.45.0`, `huggingface_hub==0.25.2`, `safetensors==0.4.5`.

## Recommendations / Next Steps
- Ensure all dynamic module loading paths call `resolve_trust_remote_code` before executing model code.
- Upgrade to vLLM v0.14.0 or later.
- Add regression tests that verify `trust_remote_code=False` blocks `auto_map` execution for local and remote models.

## Additional Notes
- Script is idempotent and was executed twice successfully.
- The reproduction uses a local model directory to avoid network dependencies while still exercising the same dynamic module loading path.