CVE-2026-27893 - Vulnerability Analysis

Overview

vLLM 0.10.1 to < 0.18.0 contains a remote code execution vulnerability caused by hardcoded trust_remote_code=True in model implementation files, letting remote attackers execute code despite user opt-out, exploit requires loading malicious model repositories.

Severity & Score

Impact

Remote attackers can execute arbitrary code despite user disabling remote code trust, leading to full system compromise.

Mitigation

Update to version 0.18.0 or later.

References

• https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72
• https://github.com/vllm-project/vllm/pull/36192
• https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner