VYPR
← All advisories
High severity7.8NVD Advisory· Published Sep 12, 2026· Updated Sep 16, 2026

CVE-2026-90553

CVE-2026-90553

Description

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Vllm/Vllminferred3 versions
    <0.28.0+ 2 more
    • (no CPE)range: <0.28.0
    • cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:*range: <0.28.0
    • (no CPE)range: <0.28.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.