# vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

vLLM's only guard restricting activation function loading is an assert, stripped under python -O, letting a malicious HuggingFace model config execute arbitrary code.

- Payout: Research
- Severity: high
- Program: vLLM
- Found by: pierreolivierbonin
- Disclosed: 2026-06-16
- CVE: CVE-2026-41523
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-q8gq-377p-jq3r
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-q8gq-377p-jq3r
- Tags: area:ai domain:ai domain:oss impact:rce kind:research platform:ghsa sev:high tech:python technique:source-review vuln:rce

**Target:** HuggingFace model config.json activation_fn loaded by vLLM pooler
**Root cause:** The sole restriction on attacker-controlled activation function qualname is an `assert function_name.startswith("torch.nn.modules.")`, which Python removes under -O/PYTHONOPTIMIZE, leaving the qualname passed unchecked to resolve_obj_by_qualname (importlib.import_module + getattr).
**Steps:**
1. Publish a HuggingFace cross-encoder model whose config.json sets `sentence_transformers.activation_fn` (or `sbert_ce_default_activation_function`) to an arbitrary qualname.
2. Victim loads the model with vLLM running under `python -O` or `PYTHONOPTIMIZE=1`.
3. Assert is stripped; `resolve_obj_by_qualname(function_name)()` imports the attacker module and calls the attribute, executing code during model init.
**How found:** Code review of the activation loading path spotted that the only security control was an assert statement, a known anti-pattern (CVE-2017-1000433, Bandit B101, Ruff S101) that vanishes under optimized mode; traced the unchecked qualname into resolve_obj_by_qualname's importlib gadget.
**Exploitation:** Attacker publishes a malicious model on HuggingFace; when a victim loads it in optimized-mode vLLM, the crafted activation_fn qualname is imported and invoked, running arbitrary code with the vLLM process privileges.
**Insight:** Grep ML/inference codebases for `assert` used as the sole gate before importlib.import_module/getattr on model-config-supplied qualnames; any assert-based allowlist is void under `python -O`, which production deployments often set.