CVE-2025-9141High· 8.8▾ TwilightvLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
An unsafe deserialization vulnerability allows any authenticated user to execute arbitrary code on the server if they are able to get the model to pass the code as an argument to a tool call.
vLLM's Qwen3 Coder tool parser contains a code execution path that uses Python's eval() function to parse tool call parameters. This occurs during the parameter conversion process when the parser attempts to handle unknown data types.
This code path is reached when:
--enable-auto-tool-choice)--tool-call-parser qwen3_coder)Remote Code Execution via Python's eval() function.
vllm >= 0.10.0, < 0.10.1.1Upgrade to a patched release:
vllm 0.10.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69147Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-57173Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-73558Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-73560Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-71486Medium· 4.3vLLM is an inference and serving engine for large language models
CVE-2026-73555Medium· 5.3vLLM is an inference and serving engine for large language models