Upwind Security MDR@UpwindMDR
Patch
🚨High - vLLM RCE via LlavaOnevision2 trust_remote_code Bypass (CVE-2026-90553) vLLM’s LlavaOnevision2 processor loader ignores trust_remote_code=False when loading remote processor classes, allowing a malicious model to ship code in processing_llava_onevision2.py that executes during processor import/initialization. Impact: remote code execution in the vLLM process context. 👉Affected: vllm < 0.28.0 | Upgrade to 0.28.0
Post summary
The alert discloses a high-severity RCE vulnerability in vLLM (CVE-2026-90553) caused by a trust_remote_code bypass in the LlavaOnevision2 processor, and explicitly advises upgrading to version 0.28.0 to remediate.
0000086
304 followersView on X