CVE-2025-9141: vLLM Remote Code Execution Vulnerability in Qwen3-Coder Tool Parser
Summary
CVE-2025-9141: vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder. Affects vllm versions >= 0.10.0, < 0.10.1.1. Fixed in 0.10.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient and scalable machine learning model serving. It provides various tools to facilitate the deployment and management of models, including the Qwen3-Coder tool, which allows users to interact with models through tool calls. However, a critical vulnerability exists in the tool call parser that can lead to remote code execution, posing significant risks to users who rely on this functionality.
Vulnerability Detail
The vulnerability arises from an unsafe deserialization process within the Qwen3-Coder tool parser, specifically when handling tool call parameters. The parser uses Python's eval() function to interpret parameters, which can be exploited by authenticated users to execute arbitrary code on the server. This occurs when tool calling is enabled, the qwen3_coder parser is specified, and the parameter type is not recognized. The potential ramifications include unauthorized access to server resources and the ability to manipulate or extract sensitive data.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.1.1
This is the first release that contains the fix.
pip install --upgrade "vllm==0.10.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable tool calling by not using the '--enable-auto-tool-choice' flag when running your application. This will prevent the vulnerable code path from being executed until you can apply the patch.
Conclusion
The vLLM package contains a critical remote code execution vulnerability in its Qwen3-Coder tool parser, which can be exploited by authenticated users. It is essential to update to the latest version to mitigate risks associated with this vulnerability. Users should also consider using Vulert for real-time monitoring of open-source vulnerabilities in their applications.
See every vulnerability recorded for vllm →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Any user of the vLLM package who has enabled tool calling and is using the Qwen3-Coder tool parser is at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider disabling tool calling as a temporary workaround to mitigate the risk.
More information can be found in the vLLM GitHub repository and the advisory database.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
