vllm-project/vllm version 0.14.1 contains a flaw where the trust_remote_code=True setting is hardcoded in two model implementation files. This bypasses the user’s explicit --trust-remote-code=False flag, allowing an attacker to trigger remote code execution through malicious HuggingFace model repositories. The vulnerability is a classic example of a trust escalation flaw that can lead to full system compromise if an attacker supplies a crafted model.

The affected product is vllm-project/vllm, specifically releases 0.14.1 and any builds that include the unchanged nemotron_vl.py and kimi_k25.py files. Deployments that load NemotronVL or KimiK25 models are at higher risk. No other vendor or product versions are listed as affected.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score is not available, so the current public exploitation probability is unclear, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the model loading process; if an attacker controls the model repository or the model loading request, they can force execution of arbitrary code due to the hardcoded trust flag. Without mitigation, any system that loads these models from potentially untrusted sources is vulnerable.