vLLM: an EPS image labeled as PNG reaches the host's Ghostscript
A crafted EPS upload to vLLM reaches the host's Ghostscript, chaining an old Ghostscript escape into command execution.
· vLLM · Research by LittlehamsterXu
vLLM passes uploaded image bytes to Pillow's format autodetection with no allowlist, so an EPS file labeled image/png reaches Ghostscript. On hosts with a Ghostscript build still open to CVE-2024-29510, that runs commands as the vLLM user.
01What happened
The vLLM project published this advisory on October 20, 2026 and credits LittlehamsterXu as the reporter, with jperezdealgaba coordinating. The reporter reproduced command execution at the loader level using Debian Ghostscript 10.03.0 and the PyPI wheel, and traced the HTTP request path in source without testing it end to end. vLLM 0.32.0, released on October 18, 2026, restricts untrusted images to raster formats.
02How it works
vLLM's ImageMediaIO hands attacker-supplied bytes to Pillow's format autodetection without a format allowlist, and the declared MIME type does not restrict which decoder runs. An EPS file sent as image/png therefore reaches the Ghostscript executable installed on the host. The advisory describes the result as an N-day dependency chain rather than a new Ghostscript flaw: the escape it ends in is CVE-2024-29510, fixed upstream in Ghostscript 10.03.1.
03Who is affected
The advisory's package table lists vllm 0.30.0. Command execution needs a Ghostscript build on the host that is still open to CVE-2024-29510, so deployments with no Ghostscript, or a fixed build, sit outside the code-execution chain. A separate denial of service applies where Pillow 12.0.0 through 12.2.0 is installed, which vLLM's unpinned requirement allowed.
04What to do
Upgrade vLLM to 0.32.0, move Ghostscript to 10.03.1 or later, and require Pillow 12.3.0 or later, which the 0.32.0 requirements now pin.
Sources 3 links, all fetched
- 1github.comvLLM Advisory
- 2github.comvLLM 0.32.0 Release
- 3github.comvLLM CORS Advisory