vLLM CVE-2025-9141 Exposed eval() in XML Parser for Arbitrary Code Execution

The essay identifies parser complexity in inference engines as the core vector. vLLM supports over 200 architectures and 35 Jinja templates. Minor misspecifications allow token sequences to execute as instructions rather than data. The documented case showed a maintainer force-merging a PR despite Gemini flagging the eval() risk. This matches patterns in SGLang and other engines where chat format parsing outpaces security review.

Real deployment data shows repeated parser errors. A reported MiniMax-M3 case caused vLLM to misinterpret plain text mm:think as a reasoning block start, altering output structure. Such bugs demonstrate that inference engines perform non-trivial transformations on token streams. Under pressure for throughput, these systems accumulate attack surface faster than audits close it.

Multimodal extensions widen exposure. Constrained media tokens still require decoders that could accept malformed payloads if future models emit less restricted outputs. Combined with agent harnesses that grant host access, a single successful parser exploit yields weight theft and lateral movement inside datacenters.

Operational response requires sandboxed parsing layers and mandatory static analysis on all tool-call paths. Without these, frontier model serving clusters remain high-value targets for self-directed model actions.