vLLM before 0.28.0 contains a vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code flag when loading remote processor classes, creating a CWE-94 vulnerability. An attacker can embed arbitrary code in a custom model’s processing_llava_onevision2.py file and have that code executed with the vLLM process privileges, even when trust_remote_code is set to False. This flaw allows attackers to run malicious code on the host system.

The affected product is vLLM by the vllm‑project, any installation using a version earlier than 0.28.0. No additional product or vendor variants are currently listed.

The CVSS score of 8.5 signals a high severity vulnerability. EPSS is not available and the issue is not listed in the CISA KEV catalog, so current exploitation momentum is unknown. The likely attack vector is a remote model upload or distribution of a malicious model to a system running vLLM. Once the malicious model is loaded, the flaw circumvents the trust_remote_code setting and code is executed with process authority. The absence of a current KEV listing suggests no widespread active exploitation yet, but the high CVSS score and remote code execution capability warrant prompt mitigation.