CVE-2025-9141: vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder

The vulnerability is a classic case of unsafe deserialization using eval(). The analysis of the provided commit 4594fc3b281713bd3d7634405b4a1393af40d294 shows the addition of the Qwen3CoderToolParser. Within this new parser, the _parse_xml_function_call method is responsible for parsing tool calls from the model's output. A nested helper function, convert_param_value, is used to cast parameter values into their correct Python types. The vulnerability is in the fallback mechanism of this type conversion. If the provided parameter value is not a standard type and cannot be decoded as JSON, the code executes eval() on the value. This is a critical security flaw. An attacker can craft input that causes the language model to generate a tool call containing a malicious payload. When the vLLM server parses this tool call, the payload is passed to eval(), resulting in arbitrary code execution. The vulnerable function that would appear in a runtime profile is Qwen3CoderToolParser._parse_xml_function_call, as it orchestrates the parsing process and contains the direct call to the vulnerable logic.