CVE-2026-54232

{"id": "CVE-2026-54232", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54232", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T14:29:54.064861Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vllm-project", "product": "vllm", "versions": [{"status": "affected", "version": "< 0.22.1"}]}]}], "published": "2026-06-22T23:16:30.873", "references": [{"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY=\"unsafe-best-match\" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1."}, {"lang": "es", "value": "vLLM es un motor de inferencia y servicio para modelos de lenguaje grandes (LLMs). Antes de la versi\u00f3n 0.22.1, el Dockerfile de vLLM es vulnerable a un ataque de confusi\u00f3n de dependencias a trav\u00e9s del paquete flashinfer-jit-cache. El paquete se instala desde un \u00edndice personalizado (flashinfer.ai/whl/) usando --extra-index-url, pero el nombre del paquete no estaba registrado en PyPI, y UV_INDEX_STRATEGY=\u2019unsafe-best-match\u2019 est\u00e1 configurado globalmente. Un atacante que registre flashinfer-jit-cache en PyPI con la versi\u00f3n 0.6.11.post2 puede ejecutar c\u00f3digo arbitrario como root durante la compilaci\u00f3n de Docker y establecer una puerta trasera en cada imagen de contenedor resultante, lo que permite la exfiltraci\u00f3n de todas las indicaciones de usuario, credenciales de API y datos del modelo de las implementaciones de vLLM en producci\u00f3n. Esta vulnerabilidad se corrige en la versi\u00f3n 0.22.1."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4FF370F-483A-4FD4-B11B-E1301D543856", "versionEndExcluding": "0.22.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}