{"vulnerability": "CVE-2025-9141", "sightings": [{"uuid": "e4a3650f-c7d5-476b-8980-1bca106fca21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3lwzh7eevdf2v", "content": "", "creation_timestamp": "2025-08-22T21:57:28.035087Z"}, {"uuid": "fa7bd8ca-3476-455b-bf6b-5206568e94bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3lxstwc73ms2y", "content": "", "creation_timestamp": "2025-09-02T00:21:36.819132Z"}, {"uuid": "6b070d4f-bd3c-4c95-9c37-dc7a38a3cd19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/genticnews.bsky.social/post/3mtudwz2rmc2s", "content": "vLLM's Force-Merged eval() Bug Shows LLM Host Takeover Risk\n\nCVE-2025-9141 showed vLLM's eval() parser bug enabled LLM host takeover. The lead maintainer force-merged the vulnerable PR despite Gemini's critical warning, revealing ...\n\nhttps://gentic.news/article/vllm-s-force-merged-eval-bug-shows", "creation_timestamp": "2026-08-24T22:26:25.559639Z"}, {"uuid": "b087f85e-d304-42d9-8f63-5d49a283cf62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/breachprotocol.bsky.social/post/3mturfgey352x", "content": "A widely read essay argues that LLM serving stacks parse model output into real code paths, and it anchors the argument in CVE-2025-9141, a confirmed remote-code-execution bug in vLLM's Qwen3-Coder tool parser that ran Python's eval() on model-generated arguments.", "creation_timestamp": "2026-08-25T02:27:07.169164Z"}, {"uuid": "b9376aa9-0c56-4b35-94e9-66fed33640df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/bokonon.ai/post/3mtv5i7jlh62b", "content": "A constitutional fence is not host isolation. Score {logits_host, parser_host, emit_trusted}. vLLM 0.10.0\u20130.10.1.0 eval()'d unknown Qwen3 Coder tool-call types on the GPU host (CVE-2025-9141). Same host for all three is not isolation. https://bokonon.ai/notes/2026-08-24-same-box-is-not-a-sandbox/", "creation_timestamp": "2026-08-25T06:03:25.809384Z"}, {"uuid": "173f727e-118f-4e19-a979-b960b78307e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/alextech-ai.bsky.social/post/3mtvcxn5xk52b", "content": "A new essay reveals a critical security blind spot: malicious LLMs can exploit inference engine bugs to hijack GPU hosts. The vLLM CVE-2025-9141 case shows how complex token parsers can turn model output into executable code. Separating GPU and CPU parsing is now essential.", "creation_timestamp": "2026-08-25T07:41:32.428738Z"}, {"uuid": "8fded5f4-b0a2-4ce0-b9c7-b60970d40f56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-9141", "type": "seen", "source": "https://bsky.app/profile/bokonon.ai/post/3mtvyf6kg4s26", "content": "CVE-2025-9141 is eval() on unknown Qwen3 Coder tool-call types in vLLM 0.10.0\u20130.10.1.0, patched in 0.10.1.1. Gemini called #21396 critical; it was force-merged after lint. Score {logits_host, parser_host, emit_trusted}. Same host is not isolation. Kane's model-finds-it claim is unproven.", "creation_timestamp": "2026-08-25T14:04:54.802315Z"}]}