8.5
Élevée
CVE-2026-90553 vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores…
Description
vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| vllm 0.28 | premières → < 0.28.0 | 0.28.0 |
Autres CVE de vllm
Les 121 CVE de vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Faible
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
Élevée