Executive brief
vLLM is a high-performance engine used to serve large language models (LLMs). A security flaw in specific model implementations allows the engine to automatically execute untrusted code from external model repositories, even if the administrator has explicitly disabled this feature. If an attacker convinces a user or system to load a malicious model from a platform like HuggingFace, they could gain full control over the server running the AI service.
Technical details
A remote code execution (RCE) vulnerability exists in vLLM v0.14.1 due to hardcoded `trust_remote_code=True` parameters within the `nemotron_vl.py` and `kimi_k25.py` model executor files. This configuration bypasses the global `--trust-remote-code=False` flag intended to prevent the execution of arbitrary Python code bundled with models. An attacker can exploit this by hosting a malicious model on a remote repository (e.g., HuggingFace) that, when loaded by a vLLM instance using these specific architectures, executes arbitrary code on the host system. This represents an incomplete fix for previous vulnerabilities (CVE-2025-66448 and CVE-2026-22807) where specific code paths remained unprotected.
Affected products
- vllm-project vLLM 0.14.1
Timeline
- 2026-05-28: advisory: NVD publication date