CWE-502

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "ch.qos.logback:logback-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-42550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-17T19:25:11Z",
    "nvd_published_at": "2021-12-16T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.",
  "id": "GHSA-668q-qrv7-99fm",
  "modified": "2021-12-17T19:25:11Z",
  "published": "2021-12-17T20:00:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42550"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cn-panda/logbackRceDemo"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/qos-ch/logback"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.html"
    },
    {
      "type": "WEB",
      "url": "https://jira.qos.ch/browse/LOGBACK-1591"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20211229-0001"
    },
    {
      "type": "WEB",
      "url": "http://logback.qos.ch/news.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Jul/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Deserialization of Untrusted Data in logback"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-73380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T15:17:06Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthenticated PHP Object Injection in Popup by Supsystic \u003c= 1.13.0 versions.",
  "id": "GHSA-66gj-6m2v-rp63",
  "modified": "2026-08-18T15:31:48Z",
  "published": "2026-08-18T15:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73380"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/popup-by-supsystic/vulnerability/wordpress-popup-by-supsystic-plugin-1-13-0-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-93941"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-10T08:17:06Z",
    "severity": "CRITICAL"
  },
  "details": "Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.",
  "id": "GHSA-66j7-cgjc-vfw6",
  "modified": "2026-10-10T09:30:29Z",
  "published": "2026-10-10T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93941"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/edema/vulnerability/wordpress-edema-theme-1-2-2-2-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-22354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-20T16:22:34Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through \u003c= 2.5.1.",
  "id": "GHSA-66q7-4wcm-7r85",
  "modified": "2026-02-24T21:31:38Z",
  "published": "2026-02-20T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22354"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/banner-management-for-woocommerce/vulnerability/wordpress-woocommerce-category-banner-management-plugin-2-5-1-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-58643"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-03T15:15:48Z",
    "severity": "HIGH"
  },
  "details": "Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes \u2013 Daylight Edition allows Object Injection. This issue affects LTL Freight Quotes \u2013 Daylight Edition: from n/a through 2.2.7.",
  "id": "GHSA-66vm-gg8j-3m49",
  "modified": "2026-04-01T18:36:03Z",
  "published": "2025-09-03T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58643"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-daylight-edition/vulnerability/wordpress-ltl-freight-quotes-daylight-edition-plugin-2-2-7-php-object-injection-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-25T07:15:07Z",
    "severity": "HIGH"
  },
  "details": "The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the \u0027frs_woo_product_tabs\u0027 parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
  "id": "GHSA-66vp-rvjr-p222",
  "modified": "2025-01-25T09:30:54Z",
  "published": "2025-01-25T09:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12600"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woocommerce-custom-product-tabs-lite/trunk/woocommerce-custom-product-tabs-lite.php#L372"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3226839"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33c16b47-3202-4f26-bf45-98172b8cac45?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.4.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "next"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "16.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-22T16:42:31Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Impact\n\nA vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a `use cache` function that returns multiple typed arrays.\n\n## Workaround\n\nThere is no known workaround for affected applications with such `use cache` functions. You should upgrade immediately even if your application does not have similar functions.",
  "id": "GHSA-673q-mjm6-r5xr",
  "modified": "2026-10-22T16:42:32Z",
  "published": "2026-10-22T16:42:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vercel/next.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vercel/next.js/releases/tag/v16.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1950"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T16:15:28Z",
    "severity": "HIGH"
  },
  "details": "The Product Carousel Slider \u0026 Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated attackers, with contributor access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
  "id": "GHSA-674m-75xm-cgv7",
  "modified": "2024-03-13T18:31:34Z",
  "published": "2024-03-13T18:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1950"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.7/includes/classes/class-meta-box.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.7/includes/classes/class-shortcode.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.7\u0026old=3045923\u0026new_path=/woo-product-carousel-slider-and-grid-ultimate/tags/1.9.8\u0026new=3045923\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8636bf-229a-42a5-a19c-332679613dd2?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-23T04:16:01Z",
    "severity": "HIGH"
  },
  "details": "Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu VectorStar. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27039.",
  "id": "GHSA-674w-pvv4-c79w",
  "modified": "2026-01-23T06:31:23Z",
  "published": "2026-01-23T06:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15350"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1201"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vllm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.32.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-115912"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-28T21:15:15Z",
    "nvd_published_at": "2026-10-26T17:17:18Z",
    "severity": "HIGH"
  },
  "details": "## Affected\n\n- **Ecosystem / package:** pip / `vllm`\n- **Affected versions:** vLLM \u003c 0.32.0.\n\n## Summary\n\nWhen `--mm-processor-cache-type shm` is enabled, vLLM\u0027s multimodal SHM cache represents a cached item with an `address` and `monotonic_id` pair and treats that pair as authority to dereference shared memory in the worker. A public scale-out request can supply its own multimodal `features.kwargs_data`, so an authenticated caller can forge an inner SHM carrier that points at attacker-controlled bytes already staged in the ring buffer. The worker then reaches `pickle.loads()` while deserializing the forged object.\n\nThis is reachable through ordinary public HTTP routes and does not require `VLLM_ALLOW_INSECURE_SERIALIZATION=1`. The live chain used `/v1/chat/completions/render` to obtain a valid feature envelope, `/v1/chat/completions` to stage attacker-chosen bytes into SHM, and `/inference/v1/generate` to submit the forged inner carrier.\n\n## Affected code\n\nLinks pinned to the confirmed commit [`752a3a504485`](https://github.com/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34) (v0.25.1):\n\n- [`vllm/distributed/device_communicators/shm_object_storage.py#L375-L400`](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/distributed/device_communicators/shm_object_storage.py#L375-L400) \u2014 SHM object deserialization reaches `pickle.loads(serialized_data)` for byte objects.\n- [`vllm/multimodal/cache.py#L567-L581`](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/multimodal/cache.py#L567-L581) \u2014 sender emits an SHM carrier containing only `address` and `monotonic_id`.\n- [`vllm/multimodal/cache.py#L711-L737`](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/multimodal/cache.py#L711-L737) \u2014 worker dereferences the untrusted pair and reads the SHM object.\n- [`vllm/entrypoints/scale_out/token_in_token_out/serving.py#L146-L173`](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/entrypoints/scale_out/token_in_token_out/serving.py#L146-L173) \u2014 public `features.kwargs_data` is decoded into engine input without authenticating SHM handles before handoff.\n\nThe public scale-out route decodes attacker-controlled `features.kwargs_data` into `MultiModalKwargsItem`s and hands them straight to the engine \u2014 no authentication of the SHM handle:\n\n```python\n# vllm/entrypoints/scale_out/token_in_token_out/serving.py Lines 155-165\n            # Deserialize tensor data when present; None \u2192 cache hit.\n            mm_kwargs: dict[str, list[MultiModalKwargsItem | None]] = {}\n            if features.kwargs_data is not None:\n                for modality, items in features.kwargs_data.items():\n                    mm_kwargs[modality] = [\n                        decode_mm_kwargs_item(item) if item is not None else None\n                        for item in items\n                    ]\n            else:\n                for modality, hashes in features.mm_hashes.items():\n                    mm_kwargs[modality] = [None] * len(hashes)\n```\n\nIn the worker, a decoded item that carries an `address` is treated as authority to dereference shared memory: the `(address, monotonic_id)` pair alone drives the read, with no binding to the cache key or to who issued the handle:\n\n```python\n# vllm/multimodal/cache.py Lines 711-723\n    @override\n    def get_and_update_item(\n        self,\n        mm_item: MultiModalKwargsItem | None,\n        mm_hash: str,\n    ) -\u003e MultiModalKwargsItem:\n        assert mm_item is not None, f\"Expected an address item for {mm_hash=}\"\n        if \"address\" in mm_item:\n            address = cast(int, mm_item[\"address\"].data)\n            monotonic_id = cast(int, mm_item[\"monotonic_id\"].data)\n            return self._shm_cache.get(address, monotonic_id)\n\n        return mm_item\n```\n\nThe dereference lands in the SHM deserializer, which `pickle.loads()` any chunk tagged as `bytes` \u2014 so attacker bytes staged in the ring buffer are unpickled in the worker process:\n\n```python\n# vllm/distributed/device_communicators/shm_object_storage.py Lines 375-400\n    def deserialize(self, data_view: memoryview) -\u003e Any:\n        # pickle.loads do not read past the end of a pickled object\n        # within a large buffer, so we can skip storing the metadata size\n        type_name, nbytes, len_arr = pickle.loads(data_view)\n        serialized_data = data_view[-nbytes:]\n\n        if type_name == torch.Tensor.__name__:\n            obj = []\n            start_idx = 0\n            for length in len_arr:\n                item_bytes = serialized_data[start_idx : start_idx + length]\n                obj.append(item_bytes)\n                start_idx += length\n            obj = self.tensor_decoder.decode(obj)\n        elif type_name == self._mm_kwargs_item_cls.__name__:\n            obj = []\n            start_idx = 0\n            for length in len_arr:\n                item_bytes = serialized_data[start_idx : start_idx + length]\n                obj.append(item_bytes)\n                start_idx += length\n            obj = self.mm_decoder.decode(obj)\n        elif type_name == bytes.__name__:\n            obj = pickle.loads(serialized_data)\n        else:\n            raise ValueError(f\"Unsupported object type \u0027{type_name}\u0027 in metadata\")\n\n        return obj\n```\n\n## Impact\n\nAn ordinary authenticated inference caller can execute arbitrary Python in the worker process on a deployment that uses SHM multimodal caching. The live proof used a benign marker gadget and also caused the EngineCore health endpoint to fall from 200 to 503 after the forged request. The exploit is reachable with `VLLM_ALLOW_INSECURE_SERIALIZATION=0`; it abuses the built-in SHM object deserializer, not the separate optional msgpack ext-hook flag.\n\n\n## Suggested Fix\n\nAuthenticate every SHM carrier with a server-issued capability bound to the cache key, address, and monotonic id; rotate the capability secret when the cache is cleared; and reject malformed or forged SHM carriers at the public scale-out boundary before engine handoff \u2014 so a forged pair never reaches the worker deref / `pickle.loads()`.\n\nThe sender emits an HMAC capability (keyed by a 32-byte secret stored in the ring buffer and rotated on `clear()`) over `(cache_key, address, monotonic_id)` alongside the pair. The public scale-out path validates it before engine handoff:\n\n```python\n# vllm/entrypoints/scale_out/token_in_token_out/serving.py\n        cache = self.online_renderer.renderer.mm_processor_cache\n        for mm_hash, item in zip(hashes, items):\n            decoded_item = decode_mm_kwargs_item(item) if item is not None else None\n            if decoded_item is not None and cache is not None:\n                # Rejects a forged (address, monotonic_id) that lacks a valid\n                # server-issued capability for this cache key.\n                cache.validate_input_item(decoded_item, mm_hash)\n            decoded_items.append(decoded_item)\n```\n\nThe worker `get()` re-checks the capability on the reader side before it ever dereferences the caller-supplied address:\n\n```python\n# vllm/distributed/device_communicators/shm_object_storage.py\n    def get(self, address, monotonic_id, capability=None, key=None):\n        if not self.is_writer:\n            # Reject forged handles before dereferencing the supplied address.\n            self.validate_capability(key, address, monotonic_id, capability)\n        with self.ring_buffer.access_buf(address) as (data_view, buf_metadata):\n            self._validate_monotonic_id(address, monotonic_id, buf_metadata)\n            obj = self.ser_de.deserialize(data_view[self.flag_bytes :])\n            ...\n```\n\nwhere `validate_capability` recomputes the HMAC with `hmac.compare_digest` and raises `Missing server-issued SHM capability for cache key.` / `Invalid server-issued SHM capability for cache key.` on any mismatch. The fix applies cleanly to `v0.25.1` and ships regression tests asserting the generate path rejects an invalid handle and that the receiver requires a matching sender handle (and a capability issued after the current `clear()`) for the cache key.\n\n## Credit\n\n**Reported by:** Patch the Planet (Trail of Bits + OpenAI collaboration)\n\nThis vulnerability was discovered using GPT-5.5-Cyber as part of the Patch the Planet security initiative.\n\n---\n\n**Proposed fix:** a proposed change for this issue is up for review in this advisory\u0027s temporary private fork: https://github.com/vllm-project/vllm-ghsa-6757-hggm-hp2w/pull/1\n\nThis advisory was fixed in [MR59357](https://github.com/vllm-project/vllm/pull/59357).",
  "id": "GHSA-6757-hggm-hp2w",
  "modified": "2026-10-28T21:15:15Z",
  "published": "2026-10-28T21:15:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-6757-hggm-hp2w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115912"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/pull/59357"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/commit/3d5625cc3c2474994107047d7a6ecb8e4008f9b0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vllm-project/vllm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vllm-project/vllm/releases/tag/v0.32.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled"
}