Beveiligingsadvies

CVE-2026-90553

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-12 12:08:56

Laatst bijgewerkt 2026-09-14 18:25:36

Toegewezen door VulnCheck

CVSS-score 8.5

Status PUBLISHED

Beschrijving

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

← Alle CVE's bekijken Bekijk op cve.org ↗