vLLM LlavaOnevision2 processor RCE despite trust_remote_code=False (CVE-2026-90553)

GitHub advisory GHSA-3c86-2m5g-59q7 (published 28 August 2026; CVE-2026-90553) covers vLLM before 0.28.0. The LlavaOnevision2 processor loader calls transformers.dynamic_module_utils.get_class_from_dynamic_module with trust_remote_code=..., but that helper has no such parameter — the flag is swallowed into **kwargs and ignored — so attacker-supplied processing_llava_onevision2.py / video_processing_llava_onevision2.py top-level code runs even when the operator set trust_remote_code=False. Because LlavaOnevision2ForConditionalGeneration is a built-in vLLM architecture, model config load does not refuse the path. NVD: CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.5 High. Patch to vLLM 0.28.0 or later. Category tech (LLM inference stack, not a model-vendor guidance item). No Australian exploitation reports on this pass. Primary: GitHub advisory; also NVD.

Product

vLLM (LLM inference engine)

Versions

Affected: versions before 0.28.0; patched: >= 0.28.0

CVSS

7.8 (CVSS 3.1); 8.5 (CVSS 4.0 High, NVD)

Exploited in Australia?

unknown

Patch to

Upgrade to vLLM 0.28.0 or later; do not load untrusted LlavaOnevision2 models even with trust_remote_code=False on older builds

Primary: GitHub GHSA-3c86-2m5g-59q7 — vLLM LlavaOnevision2 (28 Aug 2026) · Vendor: vLLM project (GitHub Security Advisory) · CVE: CVE-2026-90553 · NVD — CVE-2026-90553 (published 12 Sep 2026)

tech cloud