NVD Published Date: Sep 26, 2026

Preface: When developers or operations personnel deploy AI models using vLLM, they typically use the `–revision` or `–code-revision` parameters to pin a specific version of the model (e.g., to a reviewed security commit) to ensure the security and stability of the production environment. However, there is a design oversight in vLLM (versions 0[.]22[.]1 to 0[.]28[.]0)!

Background: For CVE-2026-100653 related to “FUNAUDIOCHAT INFERENCE WORKFLOW (vLLM)”. The accompanying infographic highlights the vulnerability. For details. please see below:

The vulnerability occurs during the initialization stage of two specific components located under Point 1: Audio Embedding Extraction & Projection in the diagram:

1. The Discrete Pathway ([ speech_tokenizer ])

•   Where it is: The first block inside pathway A.

•  The Vulnerability: This block is initialized using PreTrainedTokenizerFast[.]from_pretrained(). Because it completely omits the user’s revision or code_revision configurations, it silently pulls tracking artifacts directly from the untrusted upstream main branch instead of a locked version.

2. The Continuous Pathway ([ Whisper-mel frontend ])

•  Where it is: The first block inside pathway B.

•  The Vulnerability: This component relies on the WhisperFeatureExtractor[.]from_pretrained() initialization to correctly parse the incoming raw audio waveform into mel-spectrograms. Just like the tokenizer, the missing configuration pinning means this entire frontend ingestion logic is susceptible to remote code manipulation if the upstream repository is compromised.

Important: Even if a FunAudioChat model was substituted into the code, trust_remote_code does not fix or cause the issue. The flaw exists because funaudiochat[.]py completely forgot to forward the revision and code_revision variables into its internal Hugging Face from_pretrained() asset calls. Because vLLM omitted those variables entirely inside that specific file, Hugging Face ignored your MODEL_REVISION pin and pulled the latest main branch assets anyway.

Vulnerability details: vLLM is an inference and serving engine for large language models. In versions from 0[.]22[.]1 through 0[.]28[.]0, the operator-supplied model revision pin (–revision / –code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in vllm/model_executor/models/funaudiochat[.]py and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in vllm/model_executor/models/qwen2_vl[.]py. As a result, deployments pinned to a reviewed revision still resolve these behavior-affecting processor, tokenizer, and config artifacts from the repository’s default revision, so a later change to the upstream default branch can alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator’s configured pin. This is a supply-chain integrity and reproducibility failure for pinned deployments; it is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/cve-2026-100653