← Scan another repo

github.com/vllm-project/vllm

@ a1657a0235a7

Submitted 8/4/2026, 10:25:55 AM · Status: ok

Risk grade
F
100 / 100
Findings
1427
1 critical76 high309 medium41 low1000 info0 on CISA KEV0ATT&CK
Showing 1,427 of 1,427 findings

Findings

  • RUN using 'sudo'
    Avoid using 'RUN' with 'sudo' commands, as it can lead to unpredictable behavior.
    trivydocker/Dockerfile:178
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
    grype
  • rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
    grype
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/compilation/caching.py:129
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/compilation/caching.py:304
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/all_reduce_utils.py:410
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/all_reduce_utils.py:430
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/cpu_communicator.py:336
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/shm_broadcast.py:901
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/shm_broadcast.py:917
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/shm_object_storage.py:378
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/device_communicators/shm_object_storage.py:398
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/parallel_state.py:881
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/utils.py:248
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/utils.py:268
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/utils.py:296
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/utils.py:311
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/distributed/weight_transfer/ipc_engine.py:92
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/model_executor/models/registry.py:1488
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/model_executor/models/registry.py:1497
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepvllm/v1/serial_utils.py:479
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrepbenchmarks/kernels/graph_machete_bench.py:26
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepvllm/platforms/cpu.py:58
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepvllm/utils/cpu_resource_utils.py:221
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepvllm/utils/cpu_resource_utils.py:225
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_base:62
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_base:147
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_base:46
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_gfx1250:255
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_gfx1250:35
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.tpu:8
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm:354
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm:37
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_base_gfx1250:53
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile.rocm_base_gfx1250:73
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivydocker/Dockerfile:939
  • 'dnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/Dockerfile.s390x:94
  • 'dnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/Dockerfile.s390x:121
  • 'dnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/Dockerfile.ppc64le:27
  • 'microdnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/Dockerfile.s390x:94
  • 'microdnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/Dockerfile.s390x:121
  • 'microdnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/Dockerfile.ppc64le:27
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.rocm_base_gfx1250:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.rocm_gfx1250:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.tpu:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.xpu:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.rocm_base:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.rocm:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocker/Dockerfile.cpu:0
  • Multiple CMD instructions listed
    There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect.
    trivydocker/Dockerfile.xpu:108
  • PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
    PyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIterator` and `BoundTupleIterator` types. These implementations computed the target index using unchecked `usize` addition (`index + n`) before bounds-checking aga…
    trivy
  • Root file system is not read-only
    An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.
    trivyexamples/deployment/chart-helm/templates/deployment.yaml:28
  • Root file system is not read-only
    An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.
    trivyexamples/deployment/chart-helm/templates/deployment.yaml:80
  • Root file system is not read-only
    An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.
    trivyexamples/deployment/chart-helm/templates/job.yaml:14
  • rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
    ### Summary `bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public API `BorrowedCertRevocationList::from_der()` via the…
    trivy

This report is public.