CVE-2025-9141: vLLM's eval() Bug Exposes Old Security Flaw in AI Infrastructure

A vulnerability tracked as CVE-2025-9141 was discovered in vLLM, a popular AI inference engine, where its tool-call parser passed model-generated arguments directly into Python's eval() function. Security analysts note this is not a novel AI threat but a decades-old input-validation mistake — the same class of flaw as SQL injection or insecure deserialization — now appearing in fast-moving LLM infrastructure. Because LLM output is often treated as structured, trustworthy data rather than text from an untrusted source, it can be weaponized without requiring any sophisticated or self-aware model behavior. Inference engines like vLLM and SGLang are rapidly expanding features such as tool-calling and agentic loops, often built under competitive pressure by teams not focused on adversarial input handling. Security experts stress that model output must be treated as untrusted input, and that calling eval(), exec(), or similar functions on it violates a fundamental principle that software security has enforced for over two decades.