{“lastseen”:””,”description”:”vllm-project\/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm\/model_executor\/models\/nemotron_vl.py` and `vllm\/model_executor\/models\/kimi_k25.py`). This bypasses the user’s explicit `–trust-remote-code=False` setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.”,”published”:”2026-05-28T18:04:05.371Z”,”modified”:”2026-05-28T18:04:05.371Z”,”type”:”cve”,”title”:”Hardcoded trust_remote_code=True in vllm-project\/vllm Bypasses User Security Control”,”source”:”@huntr_ai”,”references”:”https:\/\/huntr.com\/bounties\/97f706f7-a852-49b2-a4eb-76811e611daf”,”id”:”CVE-2026-4944″,”bulletinFamily”:””,”cwe”:[“CWE-22″],”cvelist”:null,”sourceData”:”vllm-project vllm-project\/vllm unspecified”,”sourceHref”:””,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”vllm-project\/vllm”,”version”:”0.14.1″,”vendor”:”vllm-project”,”ai_description”:”Hardcoded trust_remote_code=True enables remote code execution via malicious HuggingFace model repositories”,”ai_severity”:”High”,”ai_vendor”:”vllm-project”,”ai_product”:”vllm”,”ai_version”:”0.14.1″,”ai_score”:8.8}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”vllm-project\/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm\/model_executor\/models\/nemotron_vl.py` and `vllm\/model_executor\/models\/kimi_k25.py`). This bypasses the user’s explicit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,41,12,15,13,7,11,5],"class_list":["post-57860","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n