VLLM (<= 0.29.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vllm--0.29.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 12 Sep 2026 13:20:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in vLLM LlavaOnevision2 Processor Loaderhttps://feed.craftedsignal.io/briefs/2026-09-vllm-rce/Sat, 12 Sep 2026 13:20:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-vllm-rce/A vulnerability in vLLM versions prior to 0.28.0 allows remote code execution by bypassing the trust_remote_code parameter during the loading of malicious LlavaOnevision2 processor classes.vLLM versions prior to 0.28.0 are susceptible to a high-severity remote code execution vulnerability (CVE-2026-90553) located within the LlavaOnevision2 processor loader. The vulnerability stems from a flaw in the loader logic that fails to respect the trust_remote_code configuration parameter when initializing remote processor classes. Under normal security configurations, setting trust_remote_code to False is intended to prevent the execution of arbitrary code from model repositories. However, in this implementation, the loader ignores this directive, enabling attackers to include malicious Python code within a crafted processing_llava_onevision2.py file inside a model. When the vLLM application attempts to load the malicious model, the embedded code executes with the privileges of the vLLM process. This flaw significantly impacts organizations deploying vLLM for model serving, as it allows arbitrary code execution even when users follow established security best practices.

Impact

Successful exploitation results in full remote code execution within the environment running the vLLM process. This allows attackers to gain unauthorized access to the host, steal data, or pivot further into the internal network. The vulnerability affects all users and organizations utilizing vLLM for machine learning model inference who have not yet upgraded to version 0.28.0.

Recommendation

  1. Upgrade all vLLM deployments to version 0.28.0 or later immediately to patch CVE-2026-90553.
  2. Implement strict access controls for model storage locations to prevent unauthorized modification of model files, including the processing_llava_onevision2.py script.
  3. Run vLLM processes in isolated environments, such as containers or dedicated VMs with restricted filesystem and network access, to minimize the impact of potential RCE.
  4. Perform integrity checks on model repositories before loading them into the vLLM inference engine.
]]>highadvisoryremote-code-executionmodel-inferencesupply-chaindenial-of-servicevllmvulnerability