ACVE-2026-0312

In the wild

demonstrated · research

Description

What

The cited vLLM advisory describes model classes that hard-code trust_remote_code even when the caller did not request remote code. A model repository can therefore bring Python implementation code into the serving process. The affected range is vLLM 0.10.1 through before 0.18.0 and the condition is tied to the nemotron_vl and kimi_k25 families.

Which configuration is exposed

A serving setup is exposed when vLLM in the affected range loads either named family while the recorded loader policy says trustRemoteCode is false. The false setting is important: it is the operator expectation that the vulnerable model class defeats. The lock cannot prove which Python package implementation is installed unless the serving environment is separately inventoried.

How ACVE detects it

ACVE scopes the family and trustRemoteCode condition to one models[] element. The PyPI range remains in affected for package scanners; the lock matcher is a conservative model-side signal because the current lock format does not record the vLLM distribution version. A missing policy is unknown.

Fix

Upgrade vLLM to 0.18.0 or later and rebuild the environment. Until then, do not serve the affected families from untrusted repositories, keep execution isolated, and review every model class before loading it. Record the serving package version in future lock enrichment so the package range can be confirmed.

Grounding needed

The GitHub advisory should be checked for the exact release boundary and affected class list. The current matcher intentionally notes the lock limitation instead of inventing a package-version field.

This record is limited to the condition named in the public source: vLLM model classes can force remote code loading. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  and
    family in ["nemotron_vl","kimi_k25"]
    loaderPolicy.trustRemoteCode eq false

Fix

Upgrade vLLM to 0.18.0 or later.

• Upgrade pypi:vllm to 0.18.0. Use the fixed release.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

ADVISORY

• https://github.com/advisories/GHSA-7972-pg2x-xr59