vLLM 视频处理 RCE 咨询 (CVE-2026-22778) ZXCVFIXVIBESEND ZXCVFIXVIBESEG1 受影响的 vLLM 版本可能会将视频模型部署暴露给 CVE-2026-22778。了解先决条件、修复版本和 ZXCVFIXVIBETOKEN1ZXCV 覆盖范围边界。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG2 当部署提供支持视频的模型并处理攻击者控制的视频输入时，CVE-2026-22778 会影响 vLLM 版本 0.8.3 到 0.14.0。 vLLM 0.14.1 修复了该问题。 ZXCVFIXVIBETOKEN1ZXCV 报告安全存储库依赖证据，而不是实时利用确认。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG3 ## 咨询内容 ZXCVFIXVIBESEND ZXCVFIXVIBESEG4 vLLM 项目将 ZXCVFIXVIBETOKEN2ZXCV / ZXCVFIXVIBETOKEN3ZXCV 披露为关键视频处理漏洞链。审查后的通报称，受影响的部署在提供支持视频的模型并处理攻击者控制的视频输入时可以实现远程代码执行。不提供视频模型的部署不受此通报的影响。 CVE-2026-22778 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBESEND ZXCVFIXVIBESEG5 ## 受影响的版本 ZXCVFIXVIBESEND ZXCVFIXVIBESEG6 受影响的 PyPI 版本从 vLLM 0.8.3 开始，到 0.14.1 之前停止。 PyPA 和 ZXCVFIXVIBETOKEN4ZXCV 枚举受影响的已发布版本，包括后版本和四组件版本，例如 0.8.5.post1、0.9.0.1 和 0.10.1.1。 vLLM 0.14.1 是第一个修复版本。 CVE-2026-22778 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBETOKEN2ZXCV ZXCVFIXVIBETOKEN3ZXCV ZXCVFIXVIBESEND ZXCVFIXVIBESEG7 ## 为什么部署上下文很重要 ZXCVFIXVIBESEND ZXCVFIXVIBESEG8 易受攻击的依赖项是重要的补丁分类证据，但它与易受攻击的实时服务不同。实际暴露取决于部署的包版本、运行时是否提供支持视频的模型、不受信任的用户是否可以提供视频输入以及相关的处理路径是否可达。 CVE-2026-22778 ZXCVFIXVIBESEND ZXCVFIXVIBESEG9 ## CVE-2026-22778 如何覆盖它 ZXCVFIXVIBESEND ZXCVFIXVIBESEG10 **由 CVE-2026-22778 覆盖。** ZXCVFIXVIBETOKEN1ZXCV 存储库扫描可以报告来自受支持的 Python 清单和授权存储库中的锁定文件的受影响的 vLLM 依赖项证据。该发现确定了依赖性来源、版本或允许范围、固定版本、置信度和基于版本的咨询证据态势。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG11 CVE-2026-22778 不运行 vLLM、启动模型服务器、检查加载的模型功能、提交或获取视频、练习推理路线、碰撞测试解码器、证明内存损坏或从存储库证据中声明远程代码执行。该检查有意仅限于安全依赖性分析。 ZXCVFIXVIBESEND ZXCVFIXVIBESEG12 ## 修复 ZXCVFIXVIBESEND ZXCVFIXVIBESEG13 在控制部署的依赖项源中将 vLLM 升级到 0.14.1 或更高版本。重新生成活动锁定文件并重建安装它的每个推理服务器、工作线程、笔记本、CI 映像、模型服务容器、虚拟环境、轮缓存和包缓存。验证正在运行的工件中的版本，而不仅仅是在源代码管理中。 CVE-2026-22778 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBESEND ZXCVFIXVIBESEG14 检查部署的运行时是否提供支持视频的模型或接受视频输入。在部署固定版本之前，禁用或隔离不受信任的视频处理并限制模型服务访问。使用依赖树检查、运行时版本检查、模型功能审查和良性推理冒烟测试；请勿使用精心制作的媒体或利用尝试作为验证。上游咨询和链接的修复提供了权威的修复上下文。 CVE-2026-22778 ZXCVFIXVIBETOKEN1ZXCV ZXCVFIXVIBETOKEN2ZXCV ZXCVFIXVIBETOKEN3ZXCV

What the advisory says

The vLLM project disclosed CVE-2026-22778 / GHSA-4r2x-xpjr-7cvv as a critical video-processing vulnerability chain. The reviewed advisory says an affected deployment can reach remote code execution when it serves a video-capable model and processes attacker-controlled video input. Deployments that do not serve a video model are not affected by this advisory. [S1] [S2]

Affected releases

The affected PyPI releases begin at vLLM 0.8.3 and stop before 0.14.1. PyPA and OSV enumerate the affected published releases, including post and four-component releases such as 0.8.5.post1, 0.9.0.1, and 0.10.1.1. vLLM 0.14.1 is the first fixed release. [S2] [S3] [S4] [S5]

Why deployment context matters

A vulnerable dependency is important patch-triage evidence, but it is not the same as a vulnerable live service. Practical exposure depends on the deployed package version, whether that runtime serves a video-capable model, whether untrusted users can supply video input, and whether the relevant processing path is reachable. [S1]

How FixVibe covers it

Covered by FixVibe. GitHub repo scans can report affected vLLM dependency evidence from supported Python manifests and lockfiles in an authorized repository. The finding identifies the dependency source, version or allowed range, fixed version, confidence, and a version-based advisory evidence posture.

FixVibe does not run vLLM, start a model server, inspect loaded model capabilities, submit or fetch video, exercise inference routes, crash-test decoders, prove memory corruption, or claim remote code execution from repository evidence. The check is intentionally limited to safe dependency analysis.

Remediation

Upgrade vLLM to 0.14.1 or newer in the dependency source that controls deployment. Regenerate active lockfiles and rebuild every inference server, worker, notebook, CI image, model-serving container, virtual environment, wheel cache, and package cache that installs it. Verify the version in the running artifact, not only in source control. [S3] [S5]

Review whether deployed runtimes serve video-capable models or accept video input. Until the fixed build is deployed, disable or isolate untrusted video processing and restrict model-serving access. Use dependency-tree checks, runtime-version checks, model-capability review, and benign inference smoke tests; do not use crafted media or exploitation attempts as verification. The upstream advisory and linked fixes provide the authoritative remediation context. [S1] [S6] [S7] [S8]