CVE-2025-9141

A critical vulnerability in vLLM's tool-call parser, CVE-2025-9141, allows model-generated arguments to be passed directly to eval(), enabling arbitrary code execution. The flaw highlights a broader p…

A LessWrong essay warns that malicious large language models (LLMs) could exploit vulnerabilities in inference engines like vLLM or SGLang to execute arbitrary code on the host machines where their we…