tocsin

PyPI/vllm CVE-2026-27893: high 8.8, EPSS 1.37%

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when

Action: Upgrade vllm to 0.18.0 or later.

pip install vllm==0.18.0

Affected

introducedfixedlast affected
0.10.10.18.0-

Fixed versions

0.18.0

Sources

CVE-2026-27893 · published · modified · JSON