vLLM, a large language model inference engine, contains a configuration flaw that hardcodes the option to trust remote code as true. This bypasses the user’s explicit opt‑out via the --trust-remote-code flag, allowing malicious code embedded in a model repository to execute with the privileges of the deployment process. The underlying weakness is a trust management error (CWE‑501) combined with insufficient security controls (CWE‑693). The result is a severe remote code execution vulnerability.

The affected product is vLLM from the vllm‑project. Versions from 0.10.1 up to but not including 0.18.0 are impacted. Users running these releases are susceptible to execution of arbitrary code when loading models from potentially untrusted repositories.

The CVSS score of 8.8 marks it as high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. Exploitation requires the ability to supply or influence a model load operation, typically via an administrative interface or data pipeline. Once triggered, the attacker gains the same rights as the inference service process, which may include system privileges or access to sensitive data.