vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
Description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trust_remote_code=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vllmPyPI | >= 0.10.1, < 0.18.0 | 0.18.0 |
Affected products
1Patches
100bd08edeee5[Security] Respect user trust_remote_code setting in NemotronVL and KimiK25 (#36192)
2 files changed · +7 −2
vllm/model_executor/models/kimi_k25.py+2 −1 modified@@ -174,7 +174,8 @@ def __init__(self, ctx: InputProcessingContext) -> None: self.hf_config = self.get_hf_config() self.media_token_id = self.hf_config.media_placeholder_token_id media_processor = cached_get_image_processor( - self.ctx.model_config.model, trust_remote_code=True + self.ctx.model_config.model, + trust_remote_code=self.ctx.model_config.trust_remote_code, ) self.media_processor = media_processor self.hf_processor = MoonshotKimiVAutoProcessor(
vllm/model_executor/models/nemotron_vl.py+5 −1 modified@@ -402,6 +402,7 @@ def __init__(self, *, vllm_config: VllmConfig, prefix: str = "") -> None: multimodal_config = vllm_config.model_config.multimodal_config self.config = config + self.model_config = vllm_config.model_config self.multimodal_config = multimodal_config self._patch_quant_config(config, quant_config) @@ -456,7 +457,10 @@ def _init_vision_model( *, prefix: str, ): - return AutoModel.from_config(config.vision_config, trust_remote_code=True) + return AutoModel.from_config( + config.vision_config, + trust_remote_code=self.model_config.trust_remote_code, + ) def _init_mlp1( self,
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-7972-pg2x-xr59ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27893ghsaADVISORY
- github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/pull/36192ghsax_refsource_MISCWEB
- github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.