{"id":"ghsa-ghsa-h3rc-j82p-2c3h","seq":2056927,"kind":"advisory","title":"vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE","url":"https://github.com/advisories/GHSA-h3rc-j82p-2c3h","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h3rc-j82p-2c3h","summary":"影響: pip:vllm < 0.32.0 → 0.32.0\nIn vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a host with Ghostscript affected by CVE-2024-29510, this exposes the known Ghostscript sandbox escape through vLLM's image-loading path and can execute commands with the vLLM process's privileges. A bounded marker-…","severity":"high","techs":["python"],"cves":["CVE-2026-115915"],"tags":["GHSA-h3rc-j82p-2c3h","vllm"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:15:29.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}