Description

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-12T13:16:53.887Z",
  "pubdate": "2026-09-12T13:16:53.887Z",
  "executiveSummary": "A critical remote code execution (RCE) vulnerability exists in vLLM versions prior to 0.28.0, specifically within the LlavaOnevision2 processor loader. The vulnerability stems from an insecure implementation that fails to enforce the trust_remote_code security parameter during the instantiation of remote processor classes. This flaw allows an attacker to bypass intended security controls, executing arbitrary code with the same privileges as the vLLM process. The vulnerability presents a severe risk, as it permits unauthenticated remote code execution via the submission of a maliciously crafted model. Successful exploitation leads to full system compromise, enabling attackers to execute system-level commands, exfiltrate sensitive data, or manipulate the host environment where the vLLM instance resides. This vulnerability highlights a failure in the secure loading pipeline, where user-supplied configuration files or model components are trusted without the requisite validation or authorization checks mandated by the user's security configuration.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the 'trust_remote_code' parameter within the 'LlavaOnevision2' processor loader in vLLM prior to version 0.28.0. In secure machine learning deployment environments, 'trust_remote_code=False' is a standard security configuration intended to restrict the system from executing arbitrary Python code defined within external model repositories. By design, this setting should enforce the loading of only audited or local processor classes.\nThe vulnerability occurs because the 'LlavaOnevision2' loader fails to verify or respect the 'trust_remote_code' flag when it parses and initializes the processor class defined in 'processing_llava_onevision2.py'. Consequently, when vLLM attempts to load a model containing a malicious implementation of this processing module, the loader ignores the prohibition on remote code execution. This allows the malicious Python code embedded within the 'processing_llava_onevision2.py' file to be dynamically imported and executed by the vLLM process upon model loading.\nThe exploitation flow begins when an attacker provides a reference to a maliciously crafted model repository. Because the vLLM loader bypasses the security check, it treats the malicious 'processing_llava_onevision2.py' file as a legitimate component of the model configuration. The attacker can inject arbitrary Python payloads directly into this file. When the application calls the model initialization function, the vulnerable loader triggers the 'import' or 'exec' mechanism on the attacker's script. Because the vLLM service typically requires significant system permissions to operate GPUs and memory, the injected code inherits these execution privileges. This results in the complete bypass of model isolation boundaries, granting the attacker a persistent execution context on the host machine. The lack of secondary validation for the code source during the loader's execution path effectively renders the 'trust_remote_code' security control null, making the system susceptible to any model that an attacker can force the vLLM instance to load, regardless of the user's declared security policy."
}