AIKIDO-2025-10365
vllm is vulnerable to Information Disclosure
20
Low Risk
This Affects:
vllmTL;DR
Affected versions of this package may inadvertently leak sensitive user data through logging outputs, which could be exploited by an attacker to gain unauthorized access to confidential information. By intercepting or accessing logs transmitted to LLM engine service providers, malicious actors could extract credentials, personal details, or other private data, leading to potential misuse or further attacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vllm is vulnerable to Information Disclosure in versions 0.8.3 - 0.9.0.
How to fix this
Upgrade the vllm library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant