# vLLM vulnerable to remote code execution via transformers_utils/get_config

vLLM's Nemotron_Nano_VL_Config resolves auto_map entries via get_class_from_dynamic_module and instantiates them, executing remote repo code even with trust_remote_code=False.

- Payout: Research
- Severity: high
- Program: vLLM
- Found by: Vancir
- Disclosed: 2025-12-02
- CVE: CVE-2025-66448
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-8fr4-5q9j-m8gm
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-8fr4-5q9j-m8gm
- Tags: area:ai domain:ai impact:rce kind:research platform:ghsa sev:high tech:python technique:source-review vuln:misconfiguration vuln:rce

**Target:** vllm.transformers_utils.config.get_config model config loader
**Root cause:** Nemotron_Nano_VL_Config.__init__ calls get_class_from_dynamic_module on vision_config['auto_map']['AutoConfig'] and instantiates the result without enforcing trust_remote_code or checking that the mapping points to the same repo.
**Steps:**
1. Publish a frontend model repo with a config.json whose vision_config.auto_map.AutoConfig points to a separate malicious backend repo (format `repo--Class`).
2. Victim loads the frontend config via `vllm.transformers_utils.config.get_config` with `trust_remote_code=False`.
3. Nemotron_Nano_VL_Config.__init__ splits the auto_map value on `--`, reverses it, and passes it to `get_class_from_dynamic_module(...)`.
4. The backend repo's Python is fetched and imported, then instantiated via `vision_auto_config(**vision_config)`, executing attacker code on the host.
**How found:** Reporter inspected the Nemotron_Nano_VL_Config class and noticed the auto_map entry is resolved and instantiated directly, with no trust_remote_code check and no validation that the mapping stays within the loaded repo.
**Exploitation:** Attacker needs two Hugging Face repos: a benign-looking frontend whose config.json redirects auto_map to a malicious backend. Any victim loading the frontend model config through vLLM's transformer utils runs the backend code with no further interaction, yielding arbitrary command execution on the host.
**Insight:** When auditing model-loading code, grep for get_class_from_dynamic_module / auto_map handling and check whether trust_remote_code is enforced on every path; a config class that resolves a nested auto_map can be redirected cross-repo, so a benign frontend repo becomes a code-execution pivot.