Executive brief
vLLM is a high-performance engine used to run large language models (LLMs). A security flaw was found where the software ignores a user's request to block untrusted code when loading certain specific AI models (Nemotron and Kimi). If an attacker convinces a user to load a malicious model from a remote repository, they could execute arbitrary commands on the user's system, potentially leading to full system takeover or data theft.
Technical details
A protection mechanism failure (CWE-693) exists in vLLM's model executor. Specifically, the implementation files for Nemotron-VL and Kimi-K25 hardcode 'trust_remote_code=True' during calls to HuggingFace API components (AutoModel.from_config and cached_get_image_processor). This hardcoded value overrides the global user-defined security setting intended to prevent the execution of untrusted remote code. An attacker can exploit this by hosting a malicious model repository that, when loaded by a vulnerable vLLM instance, executes arbitrary Python code. The vulnerability was patched in version 0.18.0 by ensuring these components respect the global model configuration.
Affected products
- vllm-project vllm >= 0.10.1, < 0.18.0
Timeline
- 2026-03-26: disclosed
- 2026-03-27: advisory
- 2026-03-27: patched: Version 0.18.0 released