CVE-2026-100653 vllm-project CVE debrief

Who should care

Defenders responsible for vLLM deployments should assess exposure to potential supply-chain integrity risks and verify their inventory of affected versions. They must review and update their model revision pins to prevent potential configuration changes and ensure they are not vulnerable to this issue. Additionally, defenders should prioritize verifying their inventory of vLLM deployments and assessing exposure to potential supply-chain integrity risks.

Why it matters

A supply-chain integrity issue in vLLM could allow changes to the upstream default branch to alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without operator awareness.

• Defenders must verify their inventory of vLLM deployments to ensure they are not vulnerable to supply-chain integrity risks.
• Defenders should review and update their model revision pins to prevent potential configuration changes.
• Defenders must assess exposure to potential audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration changes.

Technical summary

The operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures in vLLM versions 0.22.1-0.28.0. This issue allows a later change to the upstream default branch to alter audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without operator awareness, impacting supply-chain integrity and reproducibility for pinned deployments. The affected components include WhisperFeatureExtractor, speech_tokenizer PreTrainedTokenizerFast, and Qwen2VLConfig.

Defensive priority

Defenders should prioritize verifying their inventory of vLLM deployments and assessing exposure to potential supply-chain integrity risks. They should also review and update their model revision pins to ensure they are not vulnerable to this issue.

Recommended defensive actions

• Verify inventory of vLLM deployments
• Assess exposure to potential supply-chain integrity risks
• Review and update model revision pins
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155 and does not constitute remote code execution or a trust_remote_code=False bypass. This supply-chain integrity failure affects vLLM versions 0.22.1 through 0.28.0 and involves the propagation of operator-supplied model revision pins to Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.