Summary
vLLM versions before 0.32.0 may pass attacker-controlled image bytes to Pillow without restricting which image decoder is selected. In image-capable request paths, a crafted EPS payload could reach host-side components and may enable command execution through a vulnerable Ghostscript installation or cause worker exhaustion with certain vulnerable Pillow versions.
vLLM versions before 0.32.0 may pass attacker-controlled image bytes to Pillow without restricting which image decoder is selected. In image-capable request paths, a crafted EPS payload could reach host-side components and may enable command execution through a vulnerable Ghostscript installation or cause worker exhaustion with certain vulnerable Pillow versions.
Affected context
The issue occurs in vLLM image-processing flows that use ImageMediaIO, including paths involving parse_image() and fetch_image(). Risk depends on whether an attacker can submit image content, whether the runtime permits EPS decoding, and whether the host contains an affected Ghostscript or Pillow dependency. Deployments without the relevant vulnerable dependency are not exposed to that corresponding impact.
The issue occurs in vLLM image-processing flows that use ImageMediaIO, including paths involving parse_image() and fetch_image(). Risk depends on whether an attacker can submit image content, whether the runtime permits EPS decoding, and whether the host contains an affected Ghostscript or Pillow dependency. Deployments without the relevant vulnerable dependency are not exposed to that corresponding impact.
Exploit preconditions
- Attack surface: Image-capable vLLM request endpoints or integrations that invoke image parsing
- Required access: Ability to submit or cause processing of attacker-controlled image bytes
- Trigger point: Image loading through Pillow's
Image.open(BytesIO(data)) - Why exploitation is possible: Decoder selection is not sufficiently constrained by the MIME label, allowing content to be interpreted as a format with unsafe or resource-intensive processing behavior
- Additional conditions: Command execution depends on an affected Ghostscript environment; worker exhaustion depends on the applicable vulnerable Pillow versions and deployment configuration
- Attack surface: Image-capable vLLM request endpoints or integrations that invoke image parsing
- Required access: Ability to submit or cause processing of attacker-controlled image bytes
- Trigger point: Image loading through Pillow's
Image.open(BytesIO(data)) - Why exploitation is possible: Decoder selection is not sufficiently constrained by the MIME label, allowing content to be interpreted as a format with unsafe or resource-intensive processing behavior
- Additional conditions: Command execution depends on an affected Ghostscript environment; worker exhaustion depends on the applicable vulnerable Pillow versions and deployment configuration
Why this happens
The underlying issue is insufficient validation and canonicalization of untrusted media content. ImageMediaIO accepts attacker-controlled bytes and relies on decoder behavior without enforcing an allowlist that matches the declared media type or otherwise restricting formats such as EPS. This maps primarily to CWE-20: Improper Input Validation and is also related to CWE-183: Permissive List of Allowed Inputs, because the accepted input space is broader than the intended image formats. Downstream parser behavior can then expose host components to unexpected processing.
The underlying issue is insufficient validation and canonicalization of untrusted media content. ImageMediaIO accepts attacker-controlled bytes and relies on decoder behavior without enforcing an allowlist that matches the declared media type or otherwise restricting formats such as EPS. This maps primarily to CWE-20: Improper Input Validation and is also related to CWE-183: Permissive List of Allowed Inputs, because the accepted input space is broader than the intended image formats. Downstream parser behavior can then expose host components to unexpected processing.
Potential impact
- A vulnerable Ghostscript installation could allow command execution with the vLLM process's privileges
- An affected Pillow installation could permit media-loading worker exhaustion
- The inference service could experience request failures or degraded availability
- A compromised process could expose application data or credentials available to its runtime
- Broader host or environment impact could occur if the service has excessive privileges
- A vulnerable Ghostscript installation could allow command execution with the vLLM process's privileges
- An affected Pillow installation could permit media-loading worker exhaustion
- The inference service could experience request failures or degraded availability
- A compromised process could expose application data or credentials available to its runtime
- Broader host or environment impact could occur if the service has excessive privileges
General mitigation guidance
Mitigation generally focuses on reducing trust in uploaded media and constraining parser behavior.
Common defensive patterns include:
- Enforce a strict allowlist of supported image formats based on validated content, not only MIME labels or file extensions
- Reject EPS and other formats that invoke external interpreters unless there is a strong, isolated business requirement
- Use safe, current media-processing dependencies and isolate image decoding from sensitive host resources
- Apply resource limits for image dimensions, decompression work, memory, and processing time
- Run inference workers with least privilege, restricted filesystem access, and limited network permissions
- Keep dependency resolution and runtime images free of unnecessary interpreters such as Ghostscript
- Validate and normalize media before it reaches downstream decoders
Mitigation generally focuses on reducing trust in uploaded media and constraining parser behavior.
Common defensive patterns include:
- Enforce a strict allowlist of supported image formats based on validated content, not only MIME labels or file extensions
- Reject EPS and other formats that invoke external interpreters unless there is a strong, isolated business requirement
- Use safe, current media-processing dependencies and isolate image decoding from sensitive host resources
- Apply resource limits for image dimensions, decompression work, memory, and processing time
- Run inference workers with least privilege, restricted filesystem access, and limited network permissions
- Keep dependency resolution and runtime images free of unnecessary interpreters such as Ghostscript
- Validate and normalize media before it reaches downstream decoders
How teams detect issues like this
Detection can combine application review, dependency analysis, and runtime monitoring:
- Search for image-loading calls that accept untrusted bytes without format allowlists or content validation
- Review whether MIME labels, extensions, and detected formats are independently verified and consistently enforced
- Scan dependency and container inventories for Ghostscript and affected image-processing libraries
- Add tests using unsupported, polyglot, oversized, and resource-intensive media inputs
- Monitor image-processing latency, worker utilization, repeated decoder failures, and unusual request patterns
- Use static analysis and automated code-review policies to flag unrestricted decoder selection and unsafe media-parser boundaries
Detection can combine application review, dependency analysis, and runtime monitoring:
- Search for image-loading calls that accept untrusted bytes without format allowlists or content validation
- Review whether MIME labels, extensions, and detected formats are independently verified and consistently enforced
- Scan dependency and container inventories for Ghostscript and affected image-processing libraries
- Add tests using unsupported, polyglot, oversized, and resource-intensive media inputs
- Monitor image-processing latency, worker utilization, repeated decoder failures, and unusual request patterns
- Use static analysis and automated code-review policies to flag unrestricted decoder selection and unsafe media-parser boundaries
