Disclosed weakness · no CVE recorded

vLLM model metadata can redirect loading to a local private checkpoint

vLLM · Speculators model and tokenizer selection

First documented disclosure · Review checkpoint

Summary

A crafted repository can select another locally readable model and expose its tokenizer or inference access.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: Malicious exploitation is not established by the reviewed primary sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unchecked verifier.name_or_path metadata replaces both the chosen model and tokenizer. Absolute paths, traversal and repository-like local names can cross the intended boundary.

Conditions required

An operator loads an untrusted non-cloud-storage model repository; the serving process can read the target model. Remote-code trust need not be enabled.

Potential impact

Controlled tests exposed tokenizer contents and black-box access to the substituted model. Arbitrary host-code execution or raw weight extraction is not established.

Affected versions and configurations

Before 0.33.0, according to the maintainer advisory.

Fix and mitigation status

0.33.0; its tagged source includes the verifier validation and PyPI distribution was published November 2.

Practical next steps

Upgrade to a release containing the 0.33.0 fix and isolate each model tenant’s readable files. Select legitimate local verifiers explicitly rather than trusting repository metadata.

Operating lesson

Model configuration needs the same authorization boundary as executable extensions.

Evidence and limits

The public security fix PR dates to October 14; the detailed advisory followed November 2. No CVE is assigned in the reviewed advisory. The patch rejects local paths and symlinks before model loading; this is issue-specific remediation.

Sources