vLLM CVE-2026-90553

Exploitation requires that the victim use a vLLM installation prior to version 0.28.0 and actively load a LlavaOnevision2-architecture model from an attacker-controlled source. The victim must initiate the model loading step (UI:P), which is the standard operational workflow for any vLLM user working with multimodal models. No authentication or special system privileges are required on the victim's machine (PR:N). The attack is strictly limited to scenarios where the victim loads a malicious LlavaOnevision2 model - deployments that only load models from internal, verified registries are unaffected, as are vLLM deployments that never use the LlavaOnevision2 processor class. The trust_remote_code=False setting, which is the sole intended safeguard against this class of attack, is completely ineffective for this specific processor in unpatched versions.

The CVSS 4.0 score of 8.5 with AV:L/AC:L/AT:N/PR:N/UI:P reflects a realistic and moderately serious threat. AV:L indicates the exploit is triggered locally when the victim loads a model - this is a supply-chain/social-engineering attack pattern, not a network-reachable service attack, which meaningfully limits blast radius. The UI:P (passive user interaction) condition is realistic: in ML/AI workflows, loading third-party models is routine and often automated in pipelines. The most damaging aspect of this vulnerability is that it undermines the only documented safety control for this class of attack; operators who believe they have mitigated remote code execution risk via trust_remote_code=False are entirely unprotected for this processor. No EPSS score is present in the provided data. No CISA KEV listing exists. No POC has been identified. Real-world risk is significant for organizations with ML pipelines that load community or third-party LlavaOnevision2-architecture models, but is low for deployments using only internal, vetted models.

An attacker publishes a LlavaOnevision2-compatible model to HuggingFace Hub containing malicious code in processing_llava_onevision2.py - for example, a reverse shell or credential exfiltration routine. A data scientist or MLOps engineer running vLLM < 0.28.0 loads this model, having set trust_remote_code=False in the belief that this prevents arbitrary code execution, and the malicious processor code executes immediately with the full OS-level privileges of the vLLM inference process. No public exploit code has been identified, but the technique requires only standard Python packaging knowledge and the ability to publish a model to an accessible registry.