{"action":"Upgrade vllm to 0.10.1.1 or later.","affected":[{"fixed":"0.10.1.1","introduced":"0.10.0"}],"component":"vllm","cve_ids":["CVE-2025-9141"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.10.1.1"],"ghsa_id":"GHSA-79j6-g2m3-jgfw","id":"tcs_01M5KF5MDH7B4MTAKNTX4ZNMJY","modified_at":"2026-09-10T03:50:26.807363955Z","published_at":"2025-08-21T14:46:51Z","references":["https://osv.dev/vulnerability/GHSA-79j6-g2m3-jgfw","https://github.com/vllm-project/vllm/security/advisories/GHSA-79j6-g2m3-jgfw","https://github.com/vllm-project/vllm/pull/21396","https://github.com/vllm-project/vllm/commit/4594fc3b281713bd3d7634405b4a1393af40d294","https://github.com/vllm-project/vllm"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-79j6-g2m3-jgfw","url":"https://osv.dev/vulnerability/GHSA-79j6-g2m3-jgfw"}],"summary":"vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder"}