CVE-2026-4944 Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control
Hardcoded trust_remote_code setting in vLLM allows remote code execution via malicious models, bypassing user security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-4944?
CVE-2026-4944 is a high-severity code injection vulnerability in vllm-project/vllm, published on 28 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This bypasses the user's explicit `--trust-remote-code=False` setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.
Weakness: CWE-22
Which versions are affected by CVE-2026-4944?
How do I fix CVE-2026-4944?
No fix has been published for CVE-2026-4944 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-4944 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4944 exists.
Sources
Also known as GHSA-g57c-wgqx-8wx7.