SB2026060953 - Externally Controlled Reference to a Resource in Another Sphere in vLLM

Description

This security bulletin contains information about 1 vulnerability.

1) Externally Controlled Reference to a Resource in Another Sphere (CVE-ID: N/A)

CWE-ID: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of package resolution in docker/Dockerfile when building the Docker image with dependency installation from multiple package indexes. A remote attacker can publish a malicious package with the expected name and version on PyPI to execute arbitrary code.

User interaction is required to build the affected Docker image.

Remediation

Install update from vendor's website.

References

• https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2
• https://github.com/vllm-project/vllm/pull/44366