VLLM (< 0.32.0)

An authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data, allowing arbitrary Python execution on vLLM worker nodes via pickle.loads().