vLLM Hardcoded trust_remote_code=True Bypass
Overview
The vLLM large language model (LLM) inference and serving engine contains a critical security vulnerability. In versions 0.10.1 through 0.17.x, two specific model implementation files within vLLM inadvertently hardcoded the `trust_remote_code=True` parameter. This occurs during the loading of sub-components of certain models. The issue arises because this hardcoding overrides any user-specified configuration, including a deliberate attempt to disable remote code execution by setting `--trust-remote-code=False`. Consequently, an attacker could host a malicious model in a remote repository. When vLLM attempts to load this model, even with the security setting explicitly disabled, it will still execute arbitrary code embedded within the model's files. This bypasses the intended security measure and opens the door for remote code execution (RCE) attacks, compromising the integrity and security of the system running vLLM. The vulnerability was introduced and subsequently fixed in version 0.18.0.
Affected Systems
Testing Guide
1. Attempt to load a model from a known malicious repository using vLLM with `--trust-remote-code=False`. 2. Observe if the malicious code within the model is executed (e.g., by checking for specific outbound network connections, file creation, or process execution). A successful exploit would indicate the system is vulnerable. 3. If no unexpected behavior occurs, the system is likely not affected or has been patched.
Mitigation Steps
- Upgrade vLLM to version 0.18.0 or later. - Carefully vet all model repositories used with vLLM, even when not explicitly trusting remote code. - Implement network segmentation and firewalls to restrict outbound connections from vLLM instances. - Monitor vLLM processes for unusual network activity or file system modifications. - Consider running vLLM within a hardened container environment with limited privileges.
Patch Details
Version 0.18.0