CVE-2026-27893: vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
Summary
Two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust.
### Details
Affected files (latest main branch):
1. vllm/modelexecutor/models/nemotronvl.py:430 python visionmodel = AutoModel.fromconfig(config.visionconfig, trustremotecode=True)
2. vllm/modelexecutor/models/kimik25.py:177 python cachedgetimageprocessor(self.ctx.modelconfig.model, trustremotecode=True)
Both pass a hardcoded trustremotecode=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.
Relation to prior CVEs: - CVE-2025-66448 fixed automap resolution in vllm/transformersutils/config.py (config loading path) - CVE-2026-22807 fixed broader automap at startup - Both fixes are present in the current code. These hardcoded instances in model files survived both patches — different code paths.
Impact
Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee that trustremotecode=False is intended to provide.
Remediation: Replace hardcoded trustremotecode=True with self.config.modelconfig.trustremotecode in both files. Raise a clear error if the model component requires remote code but the user hasn't opted in.
Other sources
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/vllmto a version that resolves this vulnerability.Fixed in 0.18.0 - Upgrade
Upgrade
vllmto a version that resolves this vulnerability.Fixed in 0.18.0 - Configuration
In vllm/model_executor/models/nemotron_vl.py at the cached_get_image_processor call (currently uses trust_remote_code=True), replace the hardcoded trust_remote_code=True with self.config.model_config.trust_remote_code (i.e., use the user/config-provided setting so --trust-remote-code=False is respected).
vLLM model loading (NemotronVL) trust_remote_code = self.ctx.model_config.model_config.trust_remote_code - Configuration
In vllm/model_executor/models/kimi_k25.py at the AutoModel.from_config call (currently uses trust_remote_code=True), replace the hardcoded trust_remote_code=True with self.config.model_config.trust_remote_code (so the user's --trust-remote-code=False is enforced).
vLLM model loading (KimiK25) trust_remote_code = self.config.model_config.trust_remote_code - Compensating control
Add logic to raise a clear error when the model component requires remote code but the user hasn't opted in (per the described intended behavior in the remediation).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27893?
CVE-2026-27893 has a medium severity due to the hardcoded trust_remote_code=True, which could lead to security risks.
How do I fix CVE-2026-27893?
To fix CVE-2026-27893, update vLLM to version 0.18.0 or later, where the hardcoded setting has been removed.
Which versions of vLLM are affected by CVE-2026-27893?
vLLM versions from 0.10.1 to 0.18.0 are affected by CVE-2026-27893.
What impact does CVE-2026-27893 have on security?
CVE-2026-27893 allows untrusted remote code execution, which poses a significant security risk for applications utilizing vulnerable vLLM versions.
Can I still use vLLM if I can't update to a safe version due to compatibility issues related to CVE-2026-27893?
If you cannot update vLLM, consider disabling the functionality that relies on remote code execution to mitigate the risks associated with CVE-2026-27893.