vllm vulnerability allows remote code execution

CERT-Bund has released a security advisory (WID-SEC-2026-0890) detailing a critical vulnerability in the open-source vLLM library, a tool for efficient Large Language Model inference. The vulnerability, rated with a CVSS Base Score of 8.8, allows remote, anonymous attackers to execute arbitrary code on affected systems. The advisory specifically notes that versions of vLLM prior to 0.18.0 are vulnerable, impacting Linux and UNIX operating systems.

Organizations utilizing vLLM should immediately assess their environment for affected versions and apply available mitigations or update to a patched version (0.18.0 or later) to prevent potential exploitation. Failure to address this vulnerability could lead to unauthorized code execution, compromising system integrity and data security. Further details and CVE information are provided in the advisory.