Technical description
vLLM's video processing pipeline contains a critical RCE exploitable via a malicious video link or file, allowing unauthenticated code execution on inference servers.
Attack vector
Network, low complexity. Malicious video URL or upload triggers code execution during preprocessing.
Affected systems
Affected vLLM versions; potentially millions of inference deployments.
Mitigation
Patch vLLM to the latest version. Validate video sources. Sandbox inference workloads; restrict endpoint exposure.