Executive brief
vLLM is an open-source framework for large language model serving and inference optimization. The LlavaOnevision2 multimodal processor loader contains a security flaw that fails to properly respect the trust_remote_code safety setting, allowing attackers to execute arbitrary code when a user loads a crafted malicious model. This bypasses a key security boundary designed to protect against untrusted models.
Technical details
The vulnerability is a code injection flaw in vLLM's LlavaOnevision2 processor loader (_load_ov2_processor). The function calls transformers.dynamic_module_utils.get_class_from_dynamic_module() and passes a trust_remote_code parameter that is not accepted by that function—the parameter is silently swallowed into **kwargs and ignored. This causes the attacker-supplied processing_llava_onevision2.py and video_processing_llava_onevision2.py modules to be imported and executed unconditionally, even when trust_remote_code is explicitly set to False. The attack vector is local with required user interaction (loading the model). An attacker can achieve arbitrary code execution with the full authority of the vLLM process. The vulnerability is fixed in vLLM 0.28.0 and later.
Affected products
- vLLM Project vLLM before 0.28.0
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-3c86-2m5g-59q7 published
- 2026-09-12: advisory: CVE-2026-90553 published
- 2026-09-12: patched: Fixed in vLLM 0.28.0