vLLMPYSEC-2026-3985

vLLM: remote code execution

CVE-2026-90553 · Published Sep 12, 2026 · updated Sep 17, 2026

High7.8

Fix: upgrade to 0.28.0 or later

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

Affected versions

Package	Affected	Fixed in
vllm PyPI	< 0.28.0	0.28.0

Changes since it was listed

SeveritySep 24Severity: Unrated to High

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: NVD
Also known as: CVE-2026-90553, GHSA-3c86-2m5g-59q7

More vLLM advisories

All vLLM

High 7.5Sep 18

vLLM: unauthenticated attacker could crash the engineCVE-2026-93592fixed in 0.28.0 High 7.5Sep 17

vLLM through 0.29.0 fails to properly clean up decode-side metadata for...CVE-2026-93436fixed in 0.30.0 Medium 6.5Sep 17

vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservationCVE-2026-69147fixed in 0.28.0 Medium 6.5Sep 16

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completionsCVE-2026-57173fixed in 0.24.0 Medium 6.5Sep 8

vLLM: server-side request forgeryCVE-2026-73560fixed in 0.26.0 Medium 5.3Sep 8

vLLM: Cross-User Data Leak VulnerabilityCVE-2026-73558fixed in 0.27.0