Description
A vulnerability was found in vLLM's Qwen3 Coder tool parser. Since this parser uses Python's eval() function, it poses a risk of arbitrary code execution. This vulnerability appears during the parameter conversion process when the parser attempts to handle complex data types.
Published: n/a
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-29456 vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
Github GHSA Github GHSA GHSA-79j6-g2m3-jgfw vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder
History

Thu, 21 Aug 2025 12:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in vLLM's Qwen3 Coder tool parser. Since this parser uses Python's eval() function, it poses a risk of arbitrary code execution. This vulnerability appears during the parameter conversion process when the parser attempts to handle complex data types.
Title vllm: quen3: RCE in vllm tool call parser for qwen3coder
Weaknesses CWE-502
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Subscriptions

No data.

cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2025-08-20T23:37:00Z

Links: CVE-2025-9141 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses