CyberRota Analysis
AI-GeneratedThe vulnerability affects the vLLM inference and serving engine for large language models, specifically in the MiMoV2OmniMultiModalProcessor component, which improperly handles attacker-controlled media inputs. This flaw allows for server-side requests and unauthorized access to arbitrary files within the vLLM process, potentially leading to data exposure. Organizations utilizing versions prior to 0.26.0 should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.