{"id":"CVE-2026-90553","summary":"vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor","details":"vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.","aliases":["GHSA-3c86-2m5g-59q7"],"modified":"2026-09-13T03:47:25.006634516Z","published":"2026-09-12T12:08:56.821Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90553.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-94"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90553.json"},{"type":"ADVISORY","url":"https://github.com/vllm-project/vllm/security/advisories/GHSA-3c86-2m5g-59q7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90553"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vllm-before-0.28.0-remote-code-execution-via-llavaonevision2-processor"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vllm-project/vllm","events":[{"introduced":"0"},{"fixed":"2cf0a6915ce544dc493a0990f2ea38d81601128a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.28.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.28.0rc2","v0.28.0rc1","v0.27.2rc0","v0.26.1rc0","v0.25.0","v0.23.1rc0","v0.22.1rc0","v0.21.1rc0","v0.20.2rc0","v0.20.1rc0","v0.19.2rc0","v0.19.1rc0","v0.18.2rc0","v0.18.1rc0","v0.17.2rc0","v0.18.0rc0","v0.17.1rc0","v0.17.0rc0","v0.16.0rc1","v0.15.2rc0","v0.16.0rc0","v0.15.0rc1","v0.14.0rc1","v0.14.0rc0","v0.13.0rc1","v0.11.1","v0.11.1rc6","v0.11.1rc5","v0.11.1rc4","v0.11.1rc3","v0.11.1rc2","v0.11.1rc1","v0.11.1rc0","v0.11.0rc1","v0.10.2rc2","v0.10.2rc1","v0.10.1rc1","v0.10.0rc2","v0.10.0","v0.10.0rc1","v0.9.2rc1","v0.9.1rc2","v0.9.1","v0.9.1rc1","v0.9.0","v0.8.4","v0.8.3rc1","v0.8.2","v0.8.1","v0.8.0rc2","v0.8.0rc1","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.6.post1","v0.6.6","v0.6.5","v0.6.4.post1","v0.6.4","v0.6.3.post1","v0.6.3","v0.6.2","v0.6.1.post2","v0.6.1.post1","v0.6.1","v0.6.0","v0.5.5","v0.5.4","v0.5.3.post1","v0.5.3","v0.5.2","v0.5.1","v0.5.0.post1","v0.5.0","v0.4.3","v0.4.2","v0.4.1","v0.4.0.post1","v0.4.0","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.7","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0","submission"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90553.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}