CVE-2026-90553High· 7.8▾ TwilightvLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.
vllm < 0.28.0Upgrade past the affected range:
vllm 0.28.0Affected packages:
vllm < 0.28.0Patched in:
vllm 0.28.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69147Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-57173Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-73556Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-92365Medium· 4.3A vulnerability was found in vllm-project vllm up to 0.29.0
CVE-2026-92220Medium· 5.3A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0