GitHub Advisoryadvisory · PyPI

GHSA-cj47-qj6g-x7r4 vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

CRITICAL Published 2025-03-20 Modified 2026-06-08 Official page ↗
Aliases
CVE-2024-9053
Ecosystem
PyPI
Packages
vllm
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502, CWE-78
Reviewed
2025-03-21

Affected packages

• PyPI vllm: <= 0.6.0 (no fix yet)

Description

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution by deserializing malicious pickle data.

Related

Alias · CVE (1)

  • CVE-2024-9053 vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References