CVE-2026-27893 — vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

2026-10-03T03:07:59.750252+00:00

Affected: vllm-project vllm, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux AI 3.3, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI)

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.

GHSA-7972-pg2x-xr59 — vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

2026-10-03T03:07:59.750335+00:00

Affected: PyPI: vllm

### Summary

Two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust.

### Details

**Affected files (latest main branch):**

1. `vllm/model_executor/models/nemotron_vl.py:430` ```python vision_model = AutoModel.from_config(config.vision_config, trust_remote_code=True) ```

2. vllm/model_executor/models/kimi_k25.py:177 ```python cached_get_image_processor(self.ctx.model_config.model, trust_remote_code=True) ```

Both pass a hardcoded trust_remote_code=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.

Relation to prior CVEs: - CVE-2025-66448 fixed auto_map resolution in vllm/transformers_utils/config.py (config loading path) - CVE-2026-22807 fixed broader auto_map at startup - Both fixes are present in the current code. These hardcoded instances in model files survived both patches — different code paths.

### Impact

Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee that trust_remote_code=False is intended to provide.

Remediation: Replace hardcoded trust_remote_code=True wi…

Most recent entries from all

CVE-2026-27893 — vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out

GHSA-7972-pg2x-xr59 — vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out