What happened
vLLM versions before 0.28.0 contain an RCE vulnerability in the LlavaOnevision2 processor loader (_load_ov2_processor in llava_onevision2.py). The function calls Transformers' get_class_from_dynamic_module to load remote processor classes, but this call does not accept a trust_remote_code parameter — the setting is silently ignored, so a malicious model bundling arbitrary code in processing_llava_onevision2.py executes with vLLM process authority even when the operator has explicitly set trust_remote_code=False.
Why it matters
vLLM is one of the most widely deployed open-source LLM inference servers. This flaw defeats the primary safety control (trust_remote_code=False) that administrators rely on to prevent malicious models from executing code, meaning any environment that loads models from external or user-supplied sources is exposed to full RCE inside the inference container regardless of configuration.
Attack vector
An attacker publishes or supplies a malicious LlavaOnevision2 model containing arbitrary code in its processing_llava_onevision2.py file; when vLLM loads the model (even with trust_remote_code=False configured), the code executes with vLLM process privileges.
Affected systems
vLLM < 0.28.0
Mitigation
Upgrade to vLLM 0.28.0 or later. Until upgraded, restrict model sources to vetted repositories, avoid auto-loading untrusted models, and run vLLM with minimal container privileges.