CVE-2026-90553: vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with vLLM process authority even when trustremotecode is set to False.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments using vLLM versions before 0.28.0 that load a LlavaOnevision2 model from an untrusted source are exposed. The malicious processor code runs with the authority of the vLLM process.
Does setting trust_remote_code to False prevent exploitation?
No. The vulnerable LlavaOnevision2 processor loader ignores the trust_remote_code setting when loading remote processor classes.
What must an attacker provide to exploit this issue?
An attacker needs to induce use of a crafted malicious model containing arbitrary code in processing_llava_onevision2.py. Exploitation requires user interaction according to the supplied vector, such as selecting or loading that model.
What is the available remediation?
Upgrade vLLM to version 0.28.0 or later. If upgrading cannot happen immediately, avoid loading untrusted LlavaOnevision2 models, since trust_remote_code=False is not an effective mitigation for this processor loader.