Vulnerabilities

vLLM before 0.28.0 is vulnerable to remote code execution through its LlavaOnevision2 processor loader, which loads remote processor classes without honoring the trust_remote_code parameter. An attacker can publish or substitute a crafted model containing arbitrary code in processing_llava_onevision2.py; when a victim's vLLM instance loads that model, the code executes with the privileges of the vLLM process even if trust_remote_code is explicitly set to False. A successful attacker gains code execution in the inference server, which typically holds model weights and often has access to GPUs, internal APIs, and other cluster resources. Any deployment running an affected vLLM version that loads LlavaOnevision2-family models, particularly models pulled from public model hubs or shared registries, is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known; the CVSS vector (AV:L/UI:P) reflects that exploitation requires an operator or pipeline to load the attacker-controlled model.

Do: Upgrade to vLLM 0.28.0 or later. Until then, do not load LlavaOnevision2-family models from untrusted or unverified sources on affected versions, since setting trust_remote_code=False does not prevent exploitation. Audit which model repositories and revisions your inference pipelines pull, pin to trusted model hashes, and restrict network egress from vLLM servers to limit the impact of any code execution.