vLLMGHSA-7972-pg2x-xr59

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

CVE-2026-27893 · Published Mar 27, 2026 · updated Sep 10, 2026

High8.8

Fix: upgrade to 0.18.0 or later

Summary

Two model implementation files hardcode trust_remote_code=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model

repositories even when the user has explicitly disabled remote code trust.

### Details

Affected files (latest main branch):

1. vllm/model_executor/models/nemotron_vl.py:430

```python

vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True)

2. vllm/model_executor/models/kimi_k25.py:177

```python

cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True)

Both pass a hardcoded trust_remote_code=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.

Relation to prior CVEs:

CVE-2025-66448 fixed auto_map resolution in vllm/transformers_utils/config.py (config loading path)
CVE-2026-22807 fixed broader auto_map at startup
Both fixes are present in the current code. These hardcoded instances in model files survived both patches , different code paths.

Impact

Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee

that...

Affected versions

Package	Affected	Fixed in
vllm PyPI	>= 0.10.1, < 0.18.0	0.18.0

Details and references

### Summary Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. ### Details **Affected files (latest main branch):** 1. `vllm/model_executor/models/nemotron_vl.py:430` ```python vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True) ``` 2. vllm/model_executor/models/kimi_k25.py:177 ```python cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True) ``` Both pass a hardcoded trust_remote_code=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting. Relation to prior CVEs: - CVE-2025-66448 fixed auto_map resolution in vllm/transformers_utils/config.py (config loading path) - CVE-2026-22807 fixed broader auto_map at startup - Both fixes are present in the current code. These hardcoded instances in model files survived both patches , different code paths. ### Impact Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee that trust_remote_code=False is intended to provide. Remediation: Replace hardcoded trust_remote_code=True with self.config.model_config.trust_remote_code in both files. Raise a clear error if the model component requires remote code but the user hasn't opted in.

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-693
Also known as: CVE-2026-27893, PYSEC-2026-2297

More vLLM advisories

All vLLM

Medium 6.5May 5

vLLM Vulnerable to Remote DoS via Special-Token PlaceholdersCVE-2026-44222fixed in 0.20.0 Low 5.6Apr 27

vLLM makes Use of Uninitialized ResourceCVE-2026-7141fixed in 0.19.1 Medium 6.5Apr 3

vLLM: Denial of Service via Unbounded Frame Count in video/jpeg Base64 ProcessingCVE-2026-34755fixed in 0.19.0 Medium 5.4Apr 3

vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `CVE-2026-34753fixed in 0.19.0 Medium 6.5Apr 3

vLLM: Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API ServerCVE-2026-34756fixed in 0.19.0 Medium 5.4Mar 9

vLLM has SSRF Protection BypassCVE-2026-25960fixed in 0.17.0