vllm - 💡(How to fix) Fix releases/v0.10.1: CVE-2026-22807 trust_remote_code gate missing in transformers backend [1 participants]

TL;DR

Apply the security fix from commit 78d13ea9 to address the CVE-2026-22807 vulnerability by adding the trust_remote_code parameter and resolve_trust_remote_code gate.

Guidance

• Review the changes in commit 78d13ea9 to understand the security fix and its implications.
• Cherry-pick the commit to the releases/v0.10.1 branch to apply the fix.
• Verify that the resolve_trust_remote_code function is properly imported and used in the dynamic_module.py file.
• Test the updated code to ensure that the trust_remote_code parameter is correctly passed to the try_get_class_from_dynamic_module function.

Example

No code snippet is provided as the issue does not require a new code example, but rather applying an existing security fix.

Notes

The provided guidance assumes that the releases/v0.10.1 branch is still being maintained and that the security fix is applicable to this version.

Recommendation

Apply the workaround by cherry-picking the commit 78d13ea9 to the releases/v0.10.1 branch, as this will address the CVE-2026-22807 vulnerability and add the necessary trust_remote_code parameter and resolve_trust_remote_code gate.