The vulnerability in vLLM (CVE-2026-27893) arises because two model implementation files hardcode the parameter trust_remote_code=True when loading sub-components. This behavior overrides the user's explicit setting of --trust-remote-code=False, effectively bypassing the intended security mechanism. As a result, an attacker controlling a malicious model repository can execute arbitrary code remotely. The vulnerability affects versions from 0.10.1 up to but not including 0.18.0. Version 0.18.0 includes a patch that removes this hardcoded behavior, restoring respect for the user's security opt-out.

Successful exploitation allows remote code execution with high confidentiality, integrity, and availability impact. An attacker can run arbitrary code on the system running vLLM by supplying malicious model repositories, even if the user has explicitly disabled remote code trust. This compromises system security and can lead to full system compromise.

A fix is available in vLLM version 0.18.0, which patches the hardcoded trust_remote_code=True setting. Users should upgrade to version 0.18.0 or later to remediate this vulnerability. Refer to the Red Hat advisories for additional details and updates. No other mitigations are indicated by the vendor advisory.