vLLM: --revision pin ignored for some FunAudioChat and Tarsier2 processor, tokenizer and config loads

CVSS 8.3CVE-2026-100653AI/ML frameworks & servingcurated

Impact

In vLLM 0.22.1 through 0.28.0 the operator's --revision / --code-revision pin is not passed to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the WhisperFeatureExtractor and speech_tokenizer PreTrainedTokenizerFast loads in funaudiochat.py, and the Qwen2VLConfig.from_pretrained call used by Tarsier2ProcessingInfo in qwen2_vl.py. A deployment pinned to a reviewed revision still resolves those behaviour-affecting artifacts from the repository's default branch, so an upstream change can alter audio preprocessing, speech tokenizer behaviour or Tarsier2 configuration on the next server start with no change to the operator's config. This is a supply-chain integrity and reproducibility failure, not remote code execution: the advisory is explicit that it is neither RCE nor a trust_remote_code=False bypass. It is residual to the earlier fix tracked as GHSA-3ww4-5jv9-j5gm / CVE-2026-47155. For a fleet serving these two architectures it means the pin that audit and reproducibility claims rest on was not actually in force.

Who can reach it

No direct attacker interaction with the serving node. Requires control of, or a change to, the default branch of the upstream Hugging Face model repository the deployment loads - i.e. the model publisher or anyone who compromises that repository. Affects only deployments serving FunAudioChat or Tarsier2.

What to do

Upgrade vLLM to 0.28.0 or later and restart the serving processes; the fix is in-tree. If you serve these architectures under a pin, also verify which processor, tokenizer and config artifacts your running servers actually loaded, since a drifted default branch may already be in effect - mirroring the model repository locally at the reviewed commit removes the dependency on upstream default-branch stability. Rolling restart of the inference deployment; no node drain.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-100653 https://github.com/vllm-project/vllm/security/advisories/GHSA-hhv2-872h-628q https://github.com/vllm-project/vllm/commit/d26a28ab033697f55a1414b5b0435de7cd6045b6 https://www.vulncheck.com/advisories/vllm-0.22.1-before-0.28.0-incomplete-artifact-pin-propagation

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.