CVE-2026-27893 vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
Attackers can execute arbitrary code via malicious models because vLLM ignores the user's disabled remote code trust setting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27893?
CVE-2026-27893 is a high-severity code injection vulnerability in Vllm Vllm, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the user's explicit `--trust-remote-code=False` security opt-out. This enables remote code execution via malicious model repositories even when the user has explicitly disabled remote code trust. Version 0.18.0 patches the issue.
Which versions are affected by CVE-2026-27893?
3 open source packages ship an affected version, including vllm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vllm PyPI | From 0.10.1 | 0.18.0 |
vllm PyPI | From 0.10.1 | 0.18.0 |
vllm PyPI | From 0.10.1 | 0.18.0 |
Products include Vllm Vllm.
How do I fix CVE-2026-27893?
Upgrade vllm to 0.18.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-27893 being exploited?
There is no known exploitation of CVE-2026-27893 in the wild and no public exploit code.
Other vulnerabilities in Vllm Vllm
- CVE-2025-32444 vLLM Vulnerable to Remote Code Execution via Mooncake Integration
- CVE-2026-22778 vLLM leaks a heap address when PIL throws an error
- CVE-2025-47277 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
- CVE-2024-11041 Remote Code Execution in vllm-project/vllm
- CVE-2026-48746 vLLM: OpenAI auth bypass
Sources
Also known as GHSA-7972-pg2x-xr59, PYSEC-2026-2297.