vLLM maintainer overrode a critical eval() security flag

A vLLM maintainer force-merged a tool parser that ran eval() on model output, overriding a critical flag from Gemini's automated review, per Boyd Kane's essay on inference engine security.

The host running that parser holds the model's weights and sits inside the datacenter network with privileged access. Kane argues that makes it a far better target for an attacker than whatever laptop happens to be running an agent script.

CVE-2025-9141 names the flaw. vLLM's XML tool parser for Qwen3 Coder passed nearly every tool-call argument straight into Python's eval(). That turned a model's own output into code the host would execute.

Kane's proposed fix doesn't patch that one parser. It splits GPU execution from token parsing onto separate machines, and strips the inference host of permissions it doesn't need just to serve tokens. That way a bad parser can't reach the weights or the network the GPU box sits on.