The vulnerability in vllm-project/vllm arises from the hardcoding of the parameter trust_remote_code=True in the files vllm/model_executor/models/nemotron_vl.py and vllm/model_executor/models/kimi_k25.py. This overrides the user's explicit setting of --trust-remote-code=False, allowing remote code execution through malicious HuggingFace model repositories. This is a path traversal (CWE-22) issue and represents an incomplete fix of earlier CVEs (2025-66448 and 2026-22807) affecting different code paths. The CVSS 3.0 score is 8.8 (high), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems by loading malicious models from HuggingFace repositories. This compromises confidentiality, integrity, and availability of the system. Deployments loading NemotronVL or KimiK25 models are particularly vulnerable. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid loading NemotronVL or KimiK25 models from untrusted sources and consider disabling or restricting remote code execution features where possible. Monitor vendor communications for updates.