The vulnerability in vllm-project/vllm arises because the parameter trust_remote_code=True is hardcoded in the model files nemotron_vl.py and kimi_k25.py, overriding user configurations that disable remote code execution. This flaw enables attackers to execute arbitrary code remotely by leveraging malicious models from HuggingFace repositories. It represents an incomplete remediation of earlier vulnerabilities (CVE-2025-66448 and CVE-2026-22807) and affects separate code paths, making deployments that load NemotronVL or KimiK25 models particularly vulnerable. The CVSS 3.0 score of 8.8 reflects high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems by supplying malicious models, potentially leading to full system compromise. Confidentiality, integrity, and availability of the affected environment can be severely impacted. The vulnerability bypasses user attempts to disable remote code execution, increasing risk in deployments using the affected models.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid loading NemotronVL or KimiK25 models from untrusted sources. Monitor vendor channels for updates and apply patches promptly once available.