👋 Hi! Thank you for contributing to the vLLM project.

💬 Join our developer Slack at https://slack.vllm.ai to discuss your PR in #pr-reviews, coordinate on features in #feat- channels, or join special interest groups in #sig- channels.

PRs do not trigger a full CI run by default. Reviewers with write access and configured trusted contributors can comment /ci run for upstream CI or /amd-ci run for AMD CI only whenever CI signals are needed.

Once the PR is approved or has the ready label, the PR author can also use the corresponding /ci run, /ci retry, and /ci cancel commands, or their /amd-ci variants. New commits do not start upstream CI automatically.

If you have any questions, please reach out to us on Slack at https://slack.vllm.ai.

🚀

/ci run

✅ Triggered Buildkite CI #88535 for commit 4c588caca4ad.

The fix looks right to me, and I want to record why the new test is valid, because it is easy to glance at and think it is vacuous — I did at first.

On a freshly opened image this payload does not raise at all:

[A] image.getexif() on a fresh Image.open(...)   -> NO RAISE, returns {}
[B] ImageOps.exif_transpose() on a fresh image   -> NO RAISE
[C] suppressed exif_transpose(), then .load(),
    then getexif()                               -> SyntaxError: not a TIFF file
                                                    (header b'XXXX\x00\x00\x00\x08' not valid)

So the raise needs the earlier (suppressed) exif_transpose to have primed Pillow's lazy EXIF state first — which is exactly what ImageMediaIO.load_bytes does at vllm/multimodal/media/image.py:90-92 (normalize_image(image) → image.load() → _convert_image_mode(image)). That is the shape serialize_item sees in production, and it is what your test reproduces. .convert() carries the poisoned state forward too, so it survives the mode conversion. Pillow 12.3.0.

One call site still unguarded

While checking whether this was the only place, ImageOps.exif_transpose is called bare in the Molmo2 processor:

• vllm/model_executor/models/molmo2.py:1308 — inside that module's own exif_transpose() helper
• reached from get_image_replacement_molmo2 at vllm/model_executor/models/molmo2.py:2221

vllm/multimodal/image.py:normalize_image wraps its call in contextlib.suppress(Exception); molmo2's copy does not. Driving the same payload into exactly the state the connector hands the model processor:

img = Image.open(BytesIO(data))
with contextlib.suppress(Exception):          # normalize_image
    img = ImageOps.exif_transpose(img)
img.load()

ImageOps.exif_transpose(img)                  # molmo2.py:1308
# SyntaxError: not a TIFF file (header b'XXXX\x00\x00\x00\x08' not valid)

Same root cause and same uncaught-SyntaxError failure mode as #56527, just on the prompt-replacement path instead of the hashing path. Worth noting img.load() without the preceding suppressed transpose does not raise, which is probably why this one went unnoticed.

Happy either way on scope — it is a one-line contextlib.suppress in a single extra file if you would rather keep the class together in this PR and one CI run, and I am glad to send it as a follow-up instead once this lands. Not asking you to widen an approved PR if you would rather not.

For disclosure: I have an open PR (#54283) that reworks the framing inside serialize_item, so these two will conflict textually wherever lands second. Mine is the one that is blocked, so I will rebase onto yours — flagging it only so the conflict is not a surprise.

/ci retry

✅ Triggered Buildkite CI #89282 for commit 27a04d99f847, running 5 failed step(s) from Buildkite CI #88535.

Follow-up as promised, now that this has landed: #57234.

Molmo 2 keeps its own copy of the EXIF normalization
(vllm/model_executor/models/molmo2.py:1302) and calls
ImageOps.exif_transpose bare, so for that model this fix moved the failure one
step later rather than removing it — hashing is now tolerant, and the same
payload then raises SyntaxError out of get_image_replacement_molmo2.
Confirmed against current main:

vllm/model_executor/models/molmo2.py:1302: in exif_transpose
    images = ImageOps.exif_transpose(images)
E  SyntaxError: not a TIFF file (header b'XXXX\x00\x00\x00\x08' not valid)

That is the last bare read — grep -rn "exif_transpose\|getexif" --include=*.py vllm/
returns only multimodal/image.py (suppressed), multimodal/hasher.py (yours),
and those molmo2 lines.

One detail from your test that is worth knowing if you touch this again: with
that payload Pillow raises only on the first read of the poisoned lazy EXIF
state and silently succeeds afterwards (measured on 12.3.0). So a test that
reuses one image object across cases passes on main by coincidence; #57234
loads a fresh one per assertion for that reason.