vLLM: VLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2…
vLLM
More for vLLM RSS feed for vLLM
- Severity
- High, CVSS 7.8
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-90553
- Affects
- vLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 12, 2026
- Source last modified
- September 16, 2026
Description
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.
Description quoted from the NVD record.
Who is affected
vLLM is software that runs AI language models so that other apps and tools can use them. This flaw affects all versions before 0.28.0. The problem is in the part of vLLM that loads helper code for one particular type of AI model. vLLM has a safety setting meant to stop it from running code that comes with a downloaded model, but this part ignores that setting. An attacker could create a harmful model that, when loaded, runs their own code with the same access as vLLM itself. This flaw is rated High.
What to do
- The person who installed or runs vLLM for your organization should act on this. If an IT provider or vendor manages it for you, they should act.
- Check which version of vLLM you run. Every version before
0.28.0has this flaw. - Update vLLM to version
0.28.0or later. This is the fixed version for this flaw. - If an IT provider or vendor runs vLLM for your organization, send them this advisory and ask when the update will be done.
- If you are not sure whether your organization uses vLLM, ask whoever set up your AI tools to check.
Analysis written from the source record as of September 16, 2026 and reviewed before publishing.