SSRF and local file read vulnerability in vLLM multimodal processor

The vLLM project has disclosed a medium-severity security vulnerability, GHSA-4hhp-h66f-j5j7, affecting the multimodal processor `MiMoV2OmniMultiModalProcessor` within the `vllm/transformers_utils/processors/mimo_v2_omni.py` file. According to the GitHub Security Advisory database, the `_fetch_image` method and audio loader bypass protections implemented in `MediaConnector`, exposing the system to SSRF (Server-Side Request Forgery) and arbitrary local file read attacks. Specifically, the processor directly handles user-supplied image and audio URLs using `requests.get(...)` and local file paths using `Image.open(...)` without applying the hardened checks introduced in prior advisories GHSA-qh4c-xf7m-gxfc, GHSA-v359-jj2v-j536, and GHSA-pf3h-qjgv-vcpr.

The vulnerability allows attackers to exploit the unsanitized input passed through `multi_modal_data`, enabling arbitrary URL requests and local file reads. This includes bypassing URL-scheme allowlists, network-target allowlists, size caps, and local-path allowlists. The affected code paths are `_fetch_image` for images and a similar pattern for audio processing, both of which fail to enforce proper validation and restrictions.

Operators should carefully review any use of multimodal data inputs in their deployments before upgrading or applying mitigations. If the application processes user-supplied URLs or file paths, there is a risk of exposing sensitive local files or enabling SSRF attacks. Systems relying on multimodal capabilities should consider isolating the vulnerable components or implementing additional input validation until patches are available. This advisory highlights the importance of comprehensive input sanitization, especially when prior vulnerabilities of the same class have been addressed in related components.