AI agent vulnerability · vLLM

GHSA-x8xr-mj9x-6h7w: Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations

mediumCVSS 3.1 4.8

This advisory was withdrawn on Jun 18, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8jr5-v98p-w75m. This link is maintained to preserve external references. Original Description A flaw was found in vLLM, an open-source library for large language model inference.

Published Jun 17, 2026 · Updated Jun 18, 2026

Affected packages

vllm

Ecosystem: PyPI
Affected: >= 0.11.0, <= 0.23.0
Fixed in: No patched version yet
Check: pip show vllm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-8jr5-v98p-w75m. This link is maintained to preserve external references.

Original Description

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More vLLM vulnerabilities

All vLLM entries