{"id":"CVE-2026-4944","published":"2026-05-28T18:04:05Z","modified":"2026-05-28T19:47:23Z","title":"Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Control","vendor":"vllm-project","product":"vllm-project/vllm","tier":"tail","description":{"text":"vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This bypasses the user's explicit `--trust-remote-code=False` setting, enabling remote code execution via malicious HuggingFace model repositories. This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files. Deployments loading NemotronVL or KimiK25 models are particularly impacted.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00747,"percentile":0.5471,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://huntr.com/bounties/97f706f7-a852-49b2-a4eb-76811e611daf","tags":[]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":10.94},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"vllm-project","affectedVersions":[{"vendor":"vllm-project","product":"vllm-project/vllm","versions":[">= unspecified, <= latest"]}],"euvd":{"id":"EUVD-2026-32979","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vllm-project-vllm-cve-2025-66448","parents":[{"from":"CVE-2025-66448","to":"CVE-2026-4944","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files.","from":"CVE.org","in":"CVE-2026-4944"}]},{"from":"CVE-2026-22807","to":"CVE-2026-4944","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This issue is an incomplete fix for CVE-2025-66448 and CVE-2026-22807, as it affects separate code paths in model implementation files.","from":"CVE.org","in":"CVE-2026-4944"}]}]}}