CVE-2026-27893

Summary

  Two model implementation files hardcode trustremotecode=True when loading sub-components, bypassing the user's explicit --trust-remote-code=False security opt-out. This enables remote code execution via malicious model

  repositories even when the user has explicitly disabled remote code trust.

  ### Details

  Affected files (latest main branch):

1. vllm/modelexecutor/models/nemotronvl.py:430

  ```python

  visionmodel = AutoModel.fromconfig(config.visionconfig, trustremote_code=True)

  2. vllm/model_executor/models/kimi_k25.py:177
 

  cachedgetimageprocessor(self.ctx.modelconfig.model, trustremotecode=True)

```

  Both pass a hardcoded trustremotecode=True to HuggingFace API calls, overriding the user's global --trust-remote-code=False setting.

  Relation to prior CVEs:

• CVE-2025-66448 fixed automap resolution in vllm/transformersutils/config.py (config loading path)
• CVE-2026-22807 fixed broader auto_map at startup
• Both fixes are present in the current code. These hardcoded instances in model files survived both patches — different code paths.

Impact

  Remote code execution. An attacker can craft a malicious model repository that executes arbitrary Python code when loaded by vLLM, even when the user has explicitly set --trust-remote-code=False. This undermines the security guarantee

  that trustremotecode=False is intended to provide.

  Remediation: Replace hardcoded trustremotecode=True with self.config.modelconfig.trustremote_code in both files. Raise a clear error if the model component requires remote code but the user hasn't opted in.