CVE-2026-90553: vLLM LlavaOnevision2 RCE Vulnerability

CVE-2026-90553 Overview

CVE-2026-90553 is a remote code execution vulnerability in vLLM versions prior to 0.28.0. The flaw resides in the LlavaOnevision2 processor loader, which ignores the trust_remote_code=False parameter when loading remote processor classes. An attacker who publishes a malicious model containing arbitrary Python code in processing_llava_onevision2.py can execute that code with the authority of the vLLM process. Because the safeguard users rely on to block untrusted code is bypassed, this weakness undermines a core trust boundary in vLLM's model-loading pipeline. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Loading a malicious multimodal model in vLLM before 0.28.0 executes attacker-controlled Python even when trust_remote_code is explicitly set to False.

Affected Products

vLLM (vllm:vllm) versions before 0.28.0
Deployments serving multimodal models via the LlavaOnevision2 processor
Inference services that ingest third-party model artifacts from public model hubs

Discovery Timeline

2026-09-12 - CVE-2026-90553 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90553

Vulnerability Analysis

vLLM is a high-throughput inference engine for large language models that supports multimodal architectures through processor classes. When a user loads a model, vLLM resolves the processor implementation associated with the model's configuration. The trust_remote_code parameter is intended to gate whether Python modules shipped inside a remote model repository may be imported and executed.

In the LlavaOnevision2 processor loader, this gate is not enforced. The loader imports processing_llava_onevision2.py from the remote model regardless of the caller's setting. Any Python statements at module scope, or invoked during class construction, run inside the vLLM process. The result is arbitrary code execution under the identity of the inference service. The issue is classified as CWE-94.

Root Cause

The root cause is a missing check for the trust_remote_code flag in the code path that resolves and imports the LlavaOnevision2 processor. Trust decisions made by the caller are effectively discarded before the dynamic import occurs. This produces a divergence between the documented security contract and the loader's actual behavior.

Attack Vector

An attacker publishes a crafted model repository that includes a malicious processing_llava_onevision2.py. When a victim instructs vLLM to load that model, even with trust_remote_code=False, Python code embedded in the processor file executes. Exploitation requires user interaction to select or load the malicious model, and code runs with the privileges of the vLLM process. Full technical detail is available in the GitHub Security Advisory GHSA-3c86-2m5g-59q7 and the VulnCheck advisory on the vLLM RCE.

Detection Methods for CVE-2026-90553

Indicators of Compromise

Presence of processing_llava_onevision2.py files in downloaded model directories that contain imports of os, subprocess, socket, or builtins.exec.
Unexpected child processes spawned by the vLLM worker such as shells, package managers, or network utilities.
Outbound network connections from vLLM hosts to unfamiliar domains shortly after a model load event.
New or modified files in the vLLM service account's home directory or model cache paths outside the expected model layout.

Detection Strategies

Inventory all vLLM installations and identify versions below 0.28.0 across development, staging, and production hosts.
Hash and review any processing_llava_onevision2.py files retrieved from model hubs before loading them.
Instrument the model-load code path with logging that records the resolved processor class, source repository, and effective trust_remote_code value.

Monitoring Recommendations

Alert on process ancestry where a Python interpreter running vLLM spawns interactive shells or interpreters.
Monitor egress traffic from GPU inference nodes and baseline expected destinations such as model hubs and telemetry endpoints.
Forward vLLM application logs and host process telemetry to a centralized platform for correlation across model-load and network events.

How to Mitigate CVE-2026-90553

Immediate Actions Required

Upgrade vLLM to version 0.28.0 or later on every host that runs the inference engine.
Restrict which model repositories vLLM is permitted to load, and pin models to reviewed commits or local mirrors.
Run vLLM under a dedicated, least-privileged service account with no write access to system directories or credentials.
Isolate vLLM workers using containers or namespaces and apply egress network policies that block arbitrary outbound connections.

Patch Information

The vLLM project fixed the loader in version 0.28.0. Refer to the GitHub Security Advisory GHSA-3c86-2m5g-59q7 for the authoritative patch reference and additional guidance from the maintainers.

Workarounds

Avoid loading any model that ships a processing_llava_onevision2.py file until the host is upgraded to 0.28.0.
Serve only models from a curated internal registry, and reject artifacts that include arbitrary Python modules.
Run vLLM inside a sandbox such as a container with a read-only filesystem, seccomp filters, and denied outbound traffic to reduce impact if code executes.

bash

# Configuration example
pip install --upgrade "vllm>=0.28.0"
python -c "import vllm; print(vllm.__version__)"