Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90553vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

High 7.8

In plain English

A high-severity code injection in vLLM from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	vllm	0.28.0	PYSEC-2026-3985

Affected products (as reported)

Vendor	Product	Versions
vllm-project	vLLM	0 – before 0.28.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-3c86-2m5g-59q7) vendor-advisory
VulnCheck Advisory: vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor third-party-advisory