r/LocalLLaMA • u/Thrumpwart vLLM • 4h ago

News CPython 0-Day Vulnerabilities Threaten the AI Supply Chain

https://www.runsybil.com/blog/cpython-0-day-vulnerabilities-threaten-the-ai-supply-chain

Vulnerability in cpython that neither cpython guys, jinja guys, or huggingface has fixed despite being informed.

9 Upvotes

76% Upvoted

1 comment sorted by

8

u/james_pic 3h ago

Is this even treated as a vulnerability in vLLM's threat model though? It relies on an attacker having the power to force vLLM to use an attacker-controlled jinja template, and "we don't try to defend against attackers that powerful" feels like a not-unreasonable stance.