vLLM versions prior to 0.28.0 are vulnerable to remote code execution, allowing attackers to bypass security controls and execute arbitrary code with process authority.

The vulnerability exists in the LlavaOnevision2 processor loader, which fails to enforce the trust_remote_code parameter. This oversight allows an attacker to load malicious model files that execute arbitrary code with the privileges of the vLLM process.

Successful exploitation leads to full remote code execution, granting an attacker the ability to compromise the host system, access sensitive data, or disrupt operations. With a CVSS score of 7.8, this vulnerability represents a high risk, particularly in environments where untrusted model files are processed or hosted.

Immediate Action: Upgrade vLLM to version 0.28.0 or later to ensure the LlavaOnevision2 processor loader correctly respects the trust_remote_code parameter.

Proactive Monitoring: Monitor system logs for unauthorized file loading processes or unexpected execution of Python scripts associated with model processing.

Compensating Controls: Strictly validate the source and integrity of all model files before ingestion and ensure that the vLLM process runs with the least privilege necessary to limit the impact of potential code injection.

Public Exploit Available: Unknown

Given the severity of remote code execution, administrators should prioritize updating vLLM to version 0.28.0 immediately. Organizations using vLLM to serve models from external or untrusted sources must treat this as a high-urgency update to prevent potential system compromise.