CVE-2026-47155

Summary vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image processors, retrieval side weights, or same-repository subfolder weights/config from an unpinned/default revision. This is a supply-chain integrity issue for pinned vLLM deployments. Operators can believe they are serving a reviewed model revision while vLLM resolves behavior-affecting nested or sibling artifacts outside that reviewed revision. Details The expected invariant is: When a vLLM operator supplies a model or code revision pin, every code, config, processor, weight file, side weight, and same-repository subfolder artifact loaded as part of that model should resolve under that pin unless vLLM exposes and enforces a separate explicit pin for that artifact. Current main was verified affected at commit 3795d7acf431980e62e738493f437ae2a51549da. Affected source boundaries: - vllm/model_executor/models/registry.py:1045-1051 and :1058-1064 - _try_resolve_transformers() passes revision=model_config.revision and trust_remote_code=model_config.trust_remote_code, but omits code_revision=model_config.code_revision for external auto_map dynamic module imports. - vllm/model_executor/model_loader/gguf_loader.py:58-60 - The direct-file GGUF form repo/file.gguf calls hf_hub_download(repo_id=repo_id, filename=filename) without passing revision. - vllm/model_executor/models/roberta.py:203-209 - BGE-M3 secondary sparse and ColBERT side weights are declared with revision=None. - vllm/model_executor/models/kimi_k25.py:111-114 - Kimi-K2.5 calls cached_get_image_processor() without passing model_config.revision. - vllm/model_executor/models/kimi_audio.py:92-95 - Kimi-Audio loads Whisper config from the whisper-large-v3 subfolder without a revision argument. - vllm/model_executor/models/kimi_audio.py:425-430 - Kimi-Audio declares same-repository whisper-large-v3 seconda

[![CVE-2026-47155 status](https://www.csirts.com/badge/CVE-2026-47155)](https://www.csirts.com/cve/CVE-2026-47155)