https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:20:23 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73560 <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.</p> <p><strong>Affected:</strong> vllm-project vllm</p> <p>vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformers_utils/processors/mimo_v2_omni.py passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections and allowing server-side requests and reads of arbitrary files accessible to the vLLM process. This issue is fixed in version 0.26.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-73560 https://vulnerability.circl.lu/vuln/ghsa-4hhp-h66f-j5j7 <p><strong>Affected:</strong> PyPI: vllm</p> <p>### Summary</p> <p>`vllm/transformers_utils/processors/mimo_v2_omni.py` — the multimodal processor for `MiMoV2OmniForCausalLM` — issues `requests.get(...)` directly on user-supplied image and audio URL strings and `Image.open(...)` on user-supplied local paths, **without** the SSRF / `allowed_local_media_path` checks that `vllm.multimodal.utils.MediaConnector` was hardened with in **GHSA-qh4c-xf7m-gxfc**, **GHSA-v359-jj2v-j536**, and **GHSA-pf3h-qjgv-vcpr**.</p> <p>This is the same bug class as those three published advisories, in a code path the patches missed. When a user passes a URL or local-file string through `multi_modal_data` (e.g. `LLM.generate(multi_modal_data={&#34;image&#34;: &#34;http://...&#34;})`), the processor takes the unsanitized string and dispatches it without any URL-scheme allowlist, network-target allowlist, size cap, or local-path allowlist.</p> <p>### Details</p> <p>**File:** `vllm/transformers_utils/processors/mimo_v2_omni.py` (current `main`)</p> <p>**Sink 1 — image SSRF + local-file read (`_fetch_image`, lines 231–249):**</p> <p>```python def _fetch_image(src: Any) -&gt; Image.Image: if isinstance(src, Image.Image): return _to_rgb(src) if isinstance(src, bytes): return _to_rgb(copy.deepcopy(Image.open(BytesIO(src)))) if isinstance(src, str): if src.startswith((&#34;http://&#34;, &#34;https://&#34;)): r = requests.get(src, timeout=30) # SSRF: no allowlist, follows redirects r.raise_for_status() return _to_rgb(copy.deepcopy(Image.open…</p> <p><strong>Affected:</strong> PyPI: vllm</p> <p>### Summary</p> <p>`vllm/transformers_utils/processors/mimo_v2_omni.py` — the multimodal processor for `MiMoV2OmniForCausalLM` — issues `requests.get(...)` directly on user-supplied image and audio URL strings and `Image.open(...)` on user-supplied local paths, **without** the SSRF / `allowed_local_media_path` checks that `vllm.multimodal.utils.MediaConnector` was hardened with in **GHSA-qh4c-xf7m-gxfc**, **GHSA-v359-jj2v-j536**, and **GHSA-pf3h-qjgv-vcpr**.</p> <p>This is the same bug class as those three published advisories, in a code path the patches missed. When a user passes a URL or local-file string through `multi_modal_data` (e.g. `LLM.generate(multi_modal_data={&#34;image&#34;: &#34;http://...&#34;})`), the processor takes the unsanitized string and dispatches it without any URL-scheme allowlist, network-target allowlist, size cap, or local-path allowlist.</p> <p>### Details</p> <p>**File:** `vllm/transformers_utils/processors/mimo_v2_omni.py` (current `main`)</p> <p>**Sink 1 — image SSRF + local-file read (`_fetch_image`, lines 231–249):**</p> <p>```python def _fetch_image(src: Any) -&gt; Image.Image: if isinstance(src, Image.Image): return _to_rgb(src) if isinstance(src, bytes): return _to_rgb(copy.deepcopy(Image.open(BytesIO(src)))) if isinstance(src, str): if src.startswith((&#34;http://&#34;, &#34;https://&#34;)): r = requests.get(src, timeout=30) # SSRF: no allowlist, follows redirects r.raise_for_status() return _to_rgb(copy.deepcopy(Image.open…</p> https://vulnerability.circl.lu/vuln/ghsa-4hhp-h66f-j5j7