GHSA-7972-pg2x-xr59 CVE-2026-27893 PYSEC-2026-2297

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

High PyPI

Severity: 8.8 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.37%; Chance of exploitation in the next 30 days. Higher than 71.91% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-693 Protection Mechanism Failure
Fix: 0.18.0; Upgrade vllm to this version or later

Description

Summary

Two model implementation files hardcode trust_remote_code=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust.

Details

Affected files (latest main branch):

vllm/model_executor/models/nemotron_vl.py:430

vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True)

vllm/model_executor/models/kimi_k25.py:177

  cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True)

Both pass a hardcoded trust_remote_code=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.

Relation to prior CVEs:

CVE-2025-66448 fixed auto_map resolution in vllm/transformers_utils/config.py (config loading path)
CVE-2026-22807 fixed broader auto_map at startup
Both fixes are present in the current code. These hardcoded instances in model files survived both patches — different code paths.

Impact

Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee that trust_remote_code=False is intended to provide.

Remediation: Replace hardcoded trust_remote_code=True with self.config.model_config.trust_remote_code in both files. Raise a clear error if the model component requires remote code but the user hasn't opted in.

Affected versions

PyPI

Package	Vulnerable	Fixed in
vllm	`>= 0.10.1, < 0.18.0`	`0.18.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

vllm PyPI → `0.18.0`

pip

pip install --upgrade "vllm>=0.18.0"

poetry

poetry add "vllm>=0.18.0"

uv

uv add "vllm>=0.18.0"

Severity breakdown

CVSS 3.1 8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-693: Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-27893

Packages

github.com/vllm-project/vllm

Timeline

Mar 27, 2026 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-8397-8qf6-f2gm vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine	Medium	Also affects vllm
GHSA-x567-49g5-p4cf vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs	Medium	Also affects vllm
GHSA-vvpg-rrww-wpmh vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server	Medium	Also affects vllm
GHSA-q97c-p368-75c4 vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)	Medium	Also affects vllm
GHSA-h3rc-j82p-2c3h vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE	High	Also affects vllm
GHSA-gq5q-89c7-vhvx vLLM DeepSeek-OCR image processing vulnerable to denial of service	Medium	Also affects vllm
GHSA-6757-hggm-hp2w vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled	High	Also affects vllm
GHSA-542m-9234-8gvf vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool	Medium	Also affects vllm

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor