Summary

Untrusted image bytes were passed to Pillow without a format allowlist, so PostScript/EPS payloads could be dispatched to an external renderer during multimodal media loading. This change opens images only with an explicit raster-format allowlist on the shared media loader and the Kimi fused-vision path that also opens raw bytes.

Changes

• vllm/multimodal/image.py: add ALLOWED_IMAGE_FORMATS (Pillow Image.OPEN audit: allow native in-process readers; deny EPS, WMF, stub drivers, MPEG) and open_image().
• vllm/multimodal/media/image.py: use open_image() in ImageMediaIO.load_bytes().
• vllm/transformers_utils/processors/kimi_k25_vision_fused.py: use open_image() in _to_pil() (module-scope import).
• tests/multimodal/media/test_image.py: reject PostScript payloads; keep common raster formats accepted; assert denied plugins stay off the allowlist; assert open_image has no formats override.

Codepath coverage

• OpenAI/Anthropic multimodal chat image fetch via MediaConnector → ImageMediaIO.load_bytes / load_base64 / load_file: covered.
• Async image fetch and media-cache decode through the same ImageMediaIO methods: covered.
• video/jpeg frame decoding that reuses ImageMediaIO: covered.
• Kimi fused vision _to_pil raw bytes / data-URL / path opens: covered.
• Inkling / dots3 JPEG round-trips that reopen self-encoded raster bytes: not client sinks for this control.

Duplicate-work check

Searched open and merged PRs for ImageMediaIO, open_image, ALLOWED_IMAGE_FORMATS, and Pillow formats= allowlist wording. No open or merged PR adds a Pillow formats= allowlist on untrusted image opens.

Tests

• test_image_media_io_rejects_postscript_payload
• test_image_media_io_accepts_common_raster_formats
• test_allowed_image_formats_exclude_external_renderer_plugins
• test_kimi_fused_vision_rejects_postscript_payload
• test_open_image_does_not_accept_format_override

Commands:

PYTHONPATH=. .venv/bin/python -m pytest \
  tests/multimodal/media/test_image.py::test_image_media_io_rejects_postscript_payload \
  tests/multimodal/media/test_image.py::test_image_media_io_accepts_common_raster_formats \
  tests/multimodal/media/test_image.py::test_allowed_image_formats_exclude_external_renderer_plugins \
  tests/multimodal/media/test_image.py::test_kimi_fused_vision_rejects_postscript_payload \
  tests/multimodal/media/test_image.py::test_open_image_does_not_accept_format_override \
  -v --noconftest

All passed. pre-commit run --files on the touched paths passed.

AI assistance

This PR was developed with AI assistance.

Made with Cursor