vLLM CVE-2026-22778 - Python Inline Command Execution

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Detects vLLM executing inline Python commands using the '-c' flag, a common post-exploitation technique. This rule specifically looks for process command lines containing 'vllm' and a Python interpreter (python or python3) executing code via the '-c' flag, which is indicative of inline command execution.