The vLLM inference and serving engine for large language models has a protection mechanism failure (CWE-693) in versions >=0.10.1 and <0.18.0. Specifically, two model implementation files hardcode the parameter trust_remote_code=True when loading sub-components, ignoring the user's explicit security setting --trust-remote-code=False. This flaw allows an attacker to execute arbitrary code remotely by supplying malicious model repositories, even when users have disabled remote code trust. The vulnerability is addressed in vLLM version 0.18.0.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability. Attackers can run arbitrary code on the victim's system by leveraging malicious model repositories, bypassing user security preferences.

Upgrade to vLLM version 0.18.0 or later, where this issue is patched. Users relying on earlier versions should update promptly to eliminate the vulnerability. No other mitigations are indicated by the vendor advisory.