vLLM, the inference engine for large language models, contains a flaw in its model implementation files that hardcode trust_remote_code=True. The setting is applied when loading sub‑components, regardless of the user’s configured flag to disable remote code trust. This flaw allows a malicious model repository to execute arbitrary code on the host where vLLM runs. The vulnerability falls under configuration management weaknesses (CWE‑693) and can lead to complete compromise of the system running the engine.

vLLM (vllm‑project:vllm) versions between 0.10.1 (inclusive) and 0.18.0 (exclusive) are affected. Any deployment of these releases that loads models from remote repositories is vulnerable.

The CVSS score of 8.8 indicates a high severity. While the EPSS score is not available, the absence from the KEV catalog suggests no known public exploitation yet, yet the ability to execute remote code presents a serious threat. Based on the description, the most likely attack vector involves an attacker providing a malicious model repository and instructing vLLM to load it, thereby bypassing the explicit opt‑out. The impact can be system compromise, data exfiltration, or denial of service.