¡¾·ì϶¹«¸æ¡¿vLLM trust_remote_codeÈƹýÔ¶³Ì´úÂëÖ´Ðзì϶(CVE-2026-27893)

°ä²¼¹¦·ò 2026-03-27

Ò»¡¢·ì϶¸ÅÊö


·ìϼûû³Æ

vLLM trust_remote_codeÈƹýÔ¶³Ì´úÂëÖ´Ðзì϶

CVE   ID

CVE-2026-27893

·ì϶ÀàÐÍ

RCE

·¢ÏÖ¹¦·ò

2026-3-27

·ì϶ÆÀ·Ö

8.8

·ì϶µÈ¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍøÂç

ËùÐèȨÏÞ

ÎÞ

ÀûÓÃÄѶÈ

µÍ

Óû§½»»¥

±ØÒª

PoC/EXP

δ¹«¿ª

ÔÚÒ°ÀûÓÃ

δ·¢ÏÖ


vLLMÊÇÒ»¸ö¸ß»úÄܵĴóÄ£ÐÍÍÆÀí¿ò¼Ü£¬£¬£¬£¬£¬×¨Îª´ó¹æģ˵»°Ä£Ð͵ĸßÍÌÍÂÁ¿¡¢µÍÑÓ³¤²¿Êð¶øÉè¼Æ¡£¡£¡£¡£¡£ÆäÖ÷Ìâ¸öÐÔÔ̺¬PagedAttention¸ßЧÄÚ´æÖÎÀí¡¢²¢Ðл¯µ÷¶Å×Å»¯ÒÔ¼°¶Ô¶àGPU¡¢É¢²¼Ê½»·¾³µÄÓÅÁ¼Ö§³Ö¡£¡£¡£¡£¡£vLLM¼æÈÝHugging Face½Ó¿Ú£¬£¬£¬£¬£¬±ãÓÚÄ£Ðͼ±¾ç¼ÓÔØÓ뼯³É£¬£¬£¬£¬£¬¿í·ºÓÃÓÚÍÆÀí·þÎñ¡¢AIÀûÓúó¶ËÓë³ö²ú¼¶Ä£ÐͲ¿Ê𳡾°¡£¡£¡£¡£¡£


2026Äê3ÔÂ27ÈÕ£¬£¬£¬£¬£¬8827Ì«Ñô¼¯ÍÅ°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄ£¨VSRC£©¼à²âµ½vLLM trust_remote_codeÈƹýÔ¶³Ì´úÂëÖ´Ðзì϶¡£¡£¡£¡£¡£¸Ã·ì϶´æÔÚÓÚvllm/model_executor/models/nemotron_vl.pyºÍvllm/model_executor/models/kimi_k25.pyÎļþÖУ¬£¬£¬£¬£¬ÓÉÓÚ´úÂëÖÐÓ²±àÂëÉèÖÃtrust_remote_code=True£¬£¬£¬£¬£¬µ¼ÖÂÓû§ÏÔʽÅäÖÃtrust-remote-code=False±»Èƹý¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ý»ú¹Ø¶ñÒâHuggingFaceÄ£ÐͲֿ⣬£¬£¬£¬£¬ÔÚÄ£ÐͼÓÔعý³ÌÖÐÖ´ÐÐËÁÒâPython´úÂ룬£¬£¬£¬£¬»ñÈ¡·þÎñÆ÷Ö´ÐÐȨÏÞ£¬£¬£¬£¬£¬½ø¶øʵÏÖϵͳ½ÚÔì¡¢Êý¾ÝÇÔÈ¡»òºáÏòÒƶ¯¡£¡£¡£¡£¡£¸Ã·ì϶·ÛËéÁËtrust_remote_code°²È«»úÔìµÄÐÅÀµÌìǵ£¬£¬£¬£¬£¬¿ÉÄܵ¼ÖÂÃô¸ÐÊý¾Ýй¶¼°·þÎñ±»ÆëÈ«ÊÕÊÜ£¬£¬£¬£¬£¬´æÔڽϸߺϹæ·çÏÕ¡£¡£¡£¡£¡£


¶þ¡¢Ó°ÏìÁìÓò


vLLM >=0.10.1


Èý¡¢°²È«´ëÊ©


3.1 Éý¼¶°æ±¾


¹Ù·½ÒÑ°ä²¼½¨¸´²¹¶¡£¬£¬£¬£¬£¬ÒÔ½¨¸´¸Ã·ì϶¡£¡£¡£¡£¡£
vLLM >= 0.18.0


ÏÂÔØÁ´½Ó£ºhttps://github.com/vllm-project/vllm/releases/


3.2 һʱ´ëÊ©


ÔÝÎÞ¡£¡£¡£¡£¡£


3.3 ͨÓý¨Òé


? ¶¨ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬Ï÷¼õϵͳ·ì϶£¬£¬£¬£¬£¬ÌáÉý·þÎñÆ÷µÄ°²È«ÐÔ¡£¡£¡£¡£¡£
? ¼ÓǿϵͳºÍÍøÂçµÄ½Ó¼û½ÚÔ죬£¬£¬£¬£¬Åú¸Ä·À»ðǽսÊõ£¬£¬£¬£¬£¬¹Ø¹Ø·Ç±ØÒªµÄÀûÓö˿ڻò·þÎñ£¬£¬£¬£¬£¬Ï÷¼õ½«Î£ÏÕ·þÎñ£¨ÈçSSH¡¢RDPµÈ£©Â¶³öµ½¹«Íø£¬£¬£¬£¬£¬Ï÷¼õ¹¥»÷Ãæ¡£¡£¡£¡£¡£
? Ê¹ÓÃÆóÒµ¼¶°²È«²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂ簲ȫ»úÄÜ¡£¡£¡£¡£¡£
? ¼ÓǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöà³É·ÖÈÏÖ¤»úÔìºÍ×îÓ×ȨÏÞ×¼Ôò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞӦά³ÖÔÚ×îµÍÏ޶ȡ£¡£¡£¡£¡£

? ÆôÓÃÇ¿ÃÜÂëÕ½Êõ²¢ÉèÖÃΪ¶¨ÆÚÅú¸Ä¡£¡£¡£¡£¡£


3.4 ²Î¿¼Á´½Ó


https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59/