CVE-2026-90553 in vLLM
Summary
by MITRE • 09/12/2026
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in versions of vLLM prior to 0.28.0 represents a critical security flaw within the LlavaOneVision2 processor loader mechanism, specifically classified under CWE-94 as Improper Control of Generation of Code or Script. This issue arises from an inconsistent implementation of the trust_remote_code configuration parameter during the dynamic loading of remote processor classes. In secure software architecture, this flag is designed to act as a safeguard against executing untrusted code by ensuring that only locally verified and approved components are loaded into memory. However, in the affected versions, the LlavaOneVision2 loader fails to respect this setting when instantiating processors from remote repositories or custom paths. This oversight creates a direct path for attackers to bypass security controls intended to prevent arbitrary code execution.
The technical root cause lies in how the processor initialization logic handles external inputs without sufficient validation of their origin or integrity relative to the trust_remote_code flag. When an attacker provides a malicious model configuration that points to a remote repository containing a compromised processing_llava_onevision2.py file, the vLLM process proceeds to load and execute this code regardless of whether the user has explicitly disabled trust for remote code by setting the parameter to False. This behavior effectively neutralizes one of the primary defense-in-depth mechanisms provided by the framework against supply chain attacks or malicious model injection. The flaw allows an adversary who can influence the model loading parameters, such as through a compromised API endpoint or a social engineering attack targeting configuration files, to achieve arbitrary code execution within the context of the vLLM process.
The operational impact of this vulnerability is severe due to the elevated privileges typically held by inference engine processes. Since the malicious code executes with the authority of the vLLM process, an attacker can potentially read sensitive data processed by the model, exfiltrate information from connected systems, or use the compromised server as a pivot point for further network intrusion. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where attackers leverage system utilities to execute commands, and potentially T1204 User Execution if the vulnerability is triggered via user interaction with malicious model configurations. The ability to run arbitrary code means that confidentiality, integrity, and availability of the hosting environment are all at risk, particularly in production environments where vLLM serves high-volume inference requests.
To mitigate this risk, organizations must immediately upgrade to vLLM version 0.28.0 or later, which addresses the logic error in the LlavaOneVision2 processor loader by enforcing strict adherence to the trust_remote_code parameter across all remote loading operations. In environments where upgrading is not immediately feasible, administrators should restrict access to model repositories and ensure that only trusted, internally vetted models are loaded into inference pipelines. Additionally, implementing network segmentation to limit the exposure of vLLM services to untrusted networks can reduce the attack surface. It is also recommended to audit existing configurations for any instances where trust_remote_code might be inadvertently bypassed or misconfigured in custom deployment scripts. Regular security assessments and code reviews focusing on dynamic loading mechanisms are essential to prevent similar vulnerabilities from being introduced during future development cycles.