CVE-2026-27893

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. Two model implementation files hardcode trustremotecode=True when loading sub-components. This bypasses the user's explicit --trust-remote-code=False security opt-out, allowing a remote attacker to achieve...

CVE-2026-27893: Protection Mechanism Failure

vLLM is an inference and serving engine for large language models LLMs. Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This...