Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · vLLM

CVE-2025-9141: vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

highCVSS 3.1 8.8GHSA-79j6-g2m3-jgfw

Summary An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call. Details vLLM's Qwen3 Coder tool parser contains a code execution path that uses Python's eval() function to parse tool call parameters.

Published Aug 21, 2025

Affected packages

vllm

Ecosystem
PyPI
Affected
>= 0.10.0, < 0.10.1.1
Fixed in
0.10.1.1
Check
pip show vllm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call.

Details

vLLM's Qwen3 Coder tool parser contains a code execution path that uses Python's eval() function to parse tool call parameters. This occurs during the parameter conversion process when the parser attempts to handle unknown data types.

This code path is reached when:

  1. Tool calling is enabled (--enable-auto-tool-choice)
  2. The qwen3_coder parser is specified (--tool-call-parser qwen3_coder)
  3. The parameter type is not explicitly defined or recognized

Impact

Remote Code Execution via Python's eval() function.

Credited to levigross, russellb.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More vLLM vulnerabilities

All vLLM entries