EUVD-2026-32979
GHSA-g57c-wgqx-8wx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker registers malicious HF repo posing as NemotronVL/KimiK25 model
-
DeliveryOperator points vLLM 0.14.1 at the model ID with --trust-remote-code=False
-
ExploitLoader in nemotron_vl.py / kimi_k25.py overrides flag to True
-
ExecutionHuggingFace executes attacker's custom modeling Python
-
PersistCode runs as vllm service user with GPU access
-
ImpactExfiltrate weights, API keys, tenant prompts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) the target to run vLLM 0.14.1 and load either the NemotronVL or KimiK25 model architecture - other architectures route through code paths that correctly honor the user setting and are not affected by this specific bug; (2) the operator to issue a load against an attacker-controlled or compromised HuggingFace repository ID (UI:R), which can be achieved through social engineering, typosquatting a popular checkpoint name, or compromising an upstream HF account. The vulnerability LIMITS itself to deployments that pull models from HuggingFace at runtime: environments that exclusively serve pre-vetted local checkpoints are not exploitable in practice even on 0.14.1. The |
| Impact | CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is consistent with the description: an unauthenticated attacker hosting a malicious HF repo gains full code execution once an operator points vLLM at it, but exploitation requires that operator action (UI:R). Realistic risk is concentrated in two narrow populations - anyone serving Nemotron-VL or Kimi-K2.5 architectures on 0.14.1, especially in multi-tenant or model-marketplace deployments where untrusted model IDs can be loaded. EPSS is not provided and the CVE is not listed in CISA KEV, so there is no signal of mass exploitation; however, the bug is mechanically trivial (drop a |
| Exploit ScenarioDerived | An attacker publishes a HuggingFace repository that masquerades as a legitimate NemotronVL or KimiK25 checkpoint and includes a malicious custom modeling file. An operator running vLLM 0.14.1 with |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Remote code execution in vLLM 0.14.1 occurs because trust_remote_code=True is hardcoded inside the NemotronVL and KimiK25 model loaders, silently overriding the operator's explicit --trust-remote-code=False safety flag. Any deployment that loads a malicious or compromised HuggingFace repository for these model architectures will execute attacker-controlled Python in the inference process, despite UI:R requiring an operator to initiate the model load. No public exploit is identified at time of analysis, but the issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, indicating the regression pattern is already well understood.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the vllm-project/vllm GitHub repository and the huntr report at https://huntr.com/bounties/97f706f7-a852-49b2-a4eb-76811e611daf for a fixed release, and upgrade as soon as one beyond 0.14.1 is published that removes the hardcoded trust_remote_code=True in both files. As a compensating control, do not serve NemotronVL or KimiK25 architectures on 0.14.1 - switch to an alternative supported architecture or pin to a vllm version that does not contain these loaders. Where the model must be served, restrict model loading to a locally vetted on-disk copy (pre-download with huggingface-cli and pass a local path) so the loader cannot fetch an attacker-controlled configuration_*.py, and run vllm under a dedicated unprivileged service account in a container with no outbound network egress to HuggingFace once the model is cached; the trade-off is loss of dynamic model pulls and the operational overhead of mirroring. Locally patching the two files to honor the CLI flag is a viable stop-gap for self-built deployments but creates a fork that must be re-applied on every upgrade.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
vLLM is a high-throughput inference and serving engine for LLMs that pulls model weights and config from the HuggingFace Hub. HuggingFace's from_pretrained loaders accept a trust_remote_code flag that, when True, executes arbitrary Python shipped inside the repository (custom modeling files) - this is the documented foot-gun the CLI flag --trust-remote-code=False is meant to suppress. In vllm 0.14.1 the files vllm/model_executor/models/nemotron_vl.py and vllm/model_executor/models/kimi_k25.py pass trust_remote_code=True as a literal, bypassing the user-supplied setting. The CWE-22 (Path Traversal) classification is a poor fit for the described behavior, which is closer to CWE-94 (Code Injection) / CWE-1188 (Insecure Default Initialization); the underlying primitive is arbitrary Python execution from a remote repo, not directory traversal. CPE coverage in NVD is a wildcard against vllm-project/vllm with no version boundary published yet.
Know when Vllm Project Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
vllm-project/vllm version 0.14.1 contains a vulnerability where the trust_remote_code=True parameter is hardcoded in two model implementation files (vllm/model_executor/models/nemotron_vl.py and vllm/model_executor/models/kimi_k25.py). This bypasses the user's explicit --trust-remote-code=False setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.
Executive ViewAI
vLLM 0.14.1 contains a high-severity remote code execution vulnerability in NemotronVL and KimiK25 model loaders that silently bypasses operator-configured safety controls, allowing execution of malicious code from untrusted model repositories. Organizations deploying these model architectures face immediate risk of infrastructure compromise when loading external models, even when security policies explicitly prohibit remote code execution. This represents a regression from incomplete fixes to prior similar vulnerabilities, indicating potential systemic risk in vLLM's model loading security architecture.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Air-gap model loading to internal trusted repositories only; (2) Require security review of model repository code before loading; (3) Restrict network egress from inference processes; (4) Run inference in isolated containers with minimal privileges and network access; (5) Disable NemotronVL and KimiK25 model support if not required for operations; (6) Implement audit logging of all model loads and monitor for suspicious process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB