Blog

Topic

#security

1 article

Path diagram: model tokens become Qwen3 Coder XML, enter the vLLM tool parser, reach a highlighted eval() call and then the host; below it a version bar showing eval() present from v0.10.0 through v0.10.1 and removed in v0.10.1.1

Is the vLLM tool-call parser safe? CVE-2025-9141, the 29-day eval() window, and four checks a gateway owes you

Leo Kaka